CVE-2025-66377
📋 TL;DR
Pexip Infinity installations before version 39.0 have an internal API vulnerability where critical functions lack authentication. This allows an attacker who already has code execution on one node to affect other nodes in the same deployment. Organizations running vulnerable Pexip Infinity versions are affected.
💻 Affected Systems
- Pexip Infinity
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker with initial foothold on one node could disrupt or compromise the entire Pexip Infinity deployment, potentially causing service outages or data breaches.
Likely Case
Lateral movement within the Pexip Infinity cluster allowing attackers to expand their control from compromised nodes to other nodes.
If Mitigated
Limited to the initially compromised node with no ability to affect other infrastructure components.
🎯 Exploit Status
Exploitation requires existing access to execute code on a Pexip Infinity node, then leveraging the internal API vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 39.0 or later
Vendor Advisory: https://docs.pexip.com/admin/security_bulletins.htm
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Upgrade to Pexip Infinity version 39.0 or later following vendor upgrade procedures. 3. Verify all nodes are running patched version. 4. Test functionality after upgrade.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Pexip Infinity nodes from each other and restrict internal API communication
Access Control Hardening
allStrengthen authentication and authorization controls on all Pexip Infinity nodes
🧯 If You Can't Patch
- Implement strict network segmentation between Pexip Infinity nodes
- Enhance monitoring and alerting for suspicious internal API calls between nodes
🔍 How to Verify
Check if Vulnerable:
Check Pexip Infinity version via admin interface or CLI. If version is below 39.0, system is vulnerable.Check Version:
pexadmin --versionVerify Fix Applied:
Confirm all nodes are running version 39.0 or later and test internal API authentication.📡 Detection & Monitoring
Log Indicators:
- Unusual internal API calls between nodes
- Authentication failures for internal API endpoints
- Unexpected node-to-node communication patterns
Network Indicators:
- Abnormal internal API traffic between Pexip nodes
- Unauthenticated requests to internal API endpoints
SIEM Query:
source="pexip" AND (event_type="api_call" AND auth_status="failed") OR (src_ip IN [pexip_nodes] AND dst_ip IN [pexip_nodes] AND protocol="api")