CVE-2025-32095
📋 TL;DR
CVE-2025-32095 is an improper input validation vulnerability in Pexip Infinity's signaling component that allows remote attackers to trigger a software abort via crafted signaling messages, causing denial of service. This affects all Pexip Infinity deployments before version 37.0, potentially disrupting video conferencing services.
💻 Affected Systems
- Pexip Infinity
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of Pexip Infinity platform, rendering all video conferencing capabilities unavailable until manual restart or failover.
Likely Case
Partial or complete service interruption affecting active meetings, requiring system restart and causing meeting downtime.
If Mitigated
Minimal impact with proper network segmentation and monitoring allowing quick detection and response.
🎯 Exploit Status
Crafted signaling messages can be sent without authentication. The vulnerability is in the core signaling protocol handling.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 37.0 or later
Vendor Advisory: https://docs.pexip.com/admin/security_bulletins.htm
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Download Pexip Infinity 37.0+ from Pexip support portal. 3. Apply update via Management Node web interface or CLI. 4. Restart all nodes. 5. Verify service restoration.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to signaling ports (typically TCP 443, 3478, 5349) to trusted networks only.
Rate Limiting
allImplement rate limiting on signaling traffic to reduce impact of potential DoS attempts.
🧯 If You Can't Patch
- Implement strict network ACLs to limit signaling traffic to trusted sources only.
- Deploy WAF or IPS with rules to detect abnormal signaling patterns and block malicious traffic.
🔍 How to Verify
Check if Vulnerable:
Check Pexip Infinity version via Management Node web interface (Admin > System > About) or CLI command 'pexip --version'.Check Version:
pexip --versionVerify Fix Applied:
Confirm version is 37.0 or higher and monitor for abnormal service aborts in system logs.📡 Detection & Monitoring
Log Indicators:
- Unexpected service aborts
- Signaling process crashes
- High error rates in signaling logs
- Abnormal termination messages in systemd/journalctl
Network Indicators:
- Unusual signaling message patterns
- Spike in malformed SIP/H.323 packets
- Traffic from unexpected sources to signaling ports
SIEM Query:
source="pexip" AND ("abort" OR "crash" OR "segmentation fault") AND process="signaling"