CVE-2025-66443
📋 TL;DR
Pexip Infinity versions 35.0 through 38.1 have an improper input validation vulnerability in WebRTC signaling when using non-default Direct Media configurations. Attackers can trigger a software abort, causing temporary denial of service. Only systems with Direct Media for WebRTC enabled are affected.
💻 Affected Systems
- Pexip Infinity
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption for all WebRTC sessions using Direct Media until system restarts, potentially affecting critical video conferencing operations.
Likely Case
Targeted DoS attacks against specific meetings or users, causing temporary service interruptions that require manual intervention to restore.
If Mitigated
Minimal impact with proper network segmentation and monitoring; service automatically recovers after abort.
🎯 Exploit Status
Attack requires sending malformed signaling messages to vulnerable WebRTC endpoints with Direct Media enabled.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 39.0
Vendor Advisory: https://docs.pexip.com/admin/security_bulletins.htm
Restart Required: Yes
Instructions:
1. Backup current configuration
2. Download Pexip Infinity 39.0 from official portal
3. Follow Pexip upgrade documentation for your deployment type
4. Apply update through management interface
5. Restart services as prompted
🔧 Temporary Workarounds
Disable Direct Media for WebRTC
allSwitch to standard WebRTC configuration which is not vulnerable
pexip-config set webrtc.direct_media false
pexip-service restart
Restrict WebRTC Signaling Access
linuxLimit which networks can send WebRTC signaling to vulnerable systems
iptables -A INPUT -p tcp --dport 443 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Disable Direct Media for WebRTC configuration immediately
- Implement strict network ACLs to limit WebRTC signaling to trusted sources only
🔍 How to Verify
Check if Vulnerable:
Check if Direct Media for WebRTC is enabled in configuration and version is between 35.0-38.1Check Version:
pexip-versionVerify Fix Applied:
Confirm version is 39.0 or higher and test WebRTC functionality with Direct Media enabled📡 Detection & Monitoring
Log Indicators:
- Unexpected process aborts in Pexip logs
- WebRTC session failures with error codes
- Increased restart events for signaling services
Network Indicators:
- Spike in malformed WebRTC signaling packets
- Unusual traffic patterns to WebRTC ports from untrusted sources
SIEM Query:
source="pexip" AND ("abort" OR "crash" OR "unexpected termination") AND process="webrtc"