CVE-2025-32095: 
Pexip Infinity Management Node vulnerability analysis and mitigation

CVE-2025-32095 is an improper input validation vulnerability in Pexip Infinity's signalling component that allows a remote, unauthenticated attacker to trigger a software abort via a crafted signalling message, resulting in a denial of service. It affects all versions of Pexip Infinity before 37.0. The vulnerability was published on December 25, 2025, and carries a CVSS v3.1 base score of 7.5 (High) (Red Hat CVE, Pexip Security Bulletins).

The root cause is classified as CWE-617 (Reachable Assertion), meaning the signalling processing code contains an assertion or abort condition that can be reached by supplying a specially crafted signalling message from an external source. No authentication, user interaction, or elevated privileges are required — the attack vector is entirely network-based with low complexity. When the malformed message is processed, the assertion triggers a software abort, crashing the affected service (Red Hat CVE, Pexip Security Bulletins).

Successful exploitation causes the Pexip Infinity service to abort and become unavailable, directly impacting communication services (video conferencing, unified communications) that depend on the platform. There is no confidentiality or integrity impact — the sole consequence is a high-severity availability disruption. Organizations relying on Pexip Infinity for critical communications could experience complete service outages until the process is restarted or the system is patched (Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.034%, indicating a low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, though CISA referenced it in its weekly vulnerability bulletin for the week of December 22, 2025 (CISA Bulletin). No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing Pexip Infinity deployments running versions prior to 37.0 using network scanning tools (e.g., Shodan, Censys) targeting known Pexip signalling ports and service banners.
2. Craft malicious signalling message: Construct a specially crafted signalling message (e.g., malformed SIP, H.323, or WebRTC signalling protocol message) designed to trigger the reachable assertion in Pexip Infinity's signalling handler.
3. Transmit the message: Send the crafted message to the target Pexip Infinity node over the network without any authentication credentials or prior session establishment.
4. Trigger software abort: The Pexip Infinity signalling component processes the malformed message, hits the reachable assertion, and aborts — causing the service to crash and become unavailable to legitimate users (Pexip Security Bulletins).

• Network: Unexpected or malformed signalling messages (SIP, H.323, or WebRTC) arriving from unknown or untrusted source IPs targeting Pexip Infinity signalling ports.
• Logs: Repeated software abort or crash entries in Pexip Infinity system/application logs; unexpected process termination events correlated with inbound signalling traffic.
• Process: Sudden restart or unavailability of the Pexip Infinity service process following receipt of signalling traffic from external sources.
• System: Increased frequency of service restarts or watchdog-triggered recoveries on Pexip Infinity nodes without corresponding administrative activity.

Pexip has released version 37.0 to address this vulnerability; all users should upgrade Pexip Infinity to version 37.0 or later as the primary remediation (Pexip Security Bulletins). As a temporary workaround, administrators should restrict network access controls to limit signalling message sources to trusted endpoints only, reducing the attack surface. Additionally, monitoring logs for repeated signalling errors or unexpected service crashes can help detect exploitation attempts prior to patching.

The vulnerability received coverage from security news outlets including SecurityOnline.info shortly after disclosure, and was noted in CISA's weekly vulnerability bulletin for the week of December 22, 2025 (CISA Bulletin, SecurityOnline). Social media activity was limited, with brief mentions on Mastodon and Bluesky by security news aggregators. No significant vendor statements beyond the security bulletin or notable researcher commentary have been identified.