CVE-2025-32096

Executive Summary

CVE-2025-32096 is a high-severity (CVSS 7.5) denial-of-service vulnerability affecting Pexip Infinity, a video conferencing and collaboration platform. The flaw resides in the signaling component, where improper input validation allows an unauthenticated, remote attacker to trigger a software abort. This results in a complete denial of service, disrupting all active conferences and preventing new connections. The vulnerability affects versions 33.0 through 37.0, with the fix introduced in version 37.1. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time. However, given the critical nature of video conferencing infrastructure, immediate patching is strongly recommended.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise software product, Pexip Infinity. The supply chain risk is limited to the software vendor's distribution channels. Organizations should verify the integrity of the patch by downloading it directly from Pexip's official support portal and validating checksums if provided.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None (N) – The attacker does not need any authentication or prior access.
• User Interaction (UI): None (N) – No user action is required for exploitation.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is modified.
• Availability (A): High (H) – Complete loss of service availability.

Threat Level: High. The low attack complexity and lack of required privileges make this a significant threat to the availability of Pexip Infinity deployments. A single crafted packet can crash the signaling component, taking down the entire conferencing service.

Deep Dive & Mechanics

The vulnerability is rooted in improper input validation within the signaling module of Pexip Infinity. Signaling is the control plane responsible for establishing, maintaining, and terminating media sessions (calls/conferences). It typically handles protocols such as SIP (Session Initiation Protocol) or proprietary Pexip signaling.

The flaw likely resides in how the software parses specific fields or headers within a signaling message. An attacker can craft a malformed or specially crafted signaling packet that, when processed by the vulnerable component, triggers a software abort (e.g., a null pointer dereference, buffer overflow, or an unhandled exception). This abort causes the signaling process to crash, effectively halting all call control operations.

Because the signaling component is central to the platform's operation, its failure results in a complete denial of service. All active conferences are dropped, and new connection attempts are rejected until the service is manually restarted or automatically recovered (if high-availability mechanisms are in place). The attack is purely network-based and requires no authentication, making it trivially exploitable by any host that can reach the Pexip Infinity management or media ports.

Vulnerable vs. Patched Code

Since Pexip Infinity is a proprietary product, the exact source code diff is not publicly available. However, based on the CVE description, the fix involves hardening input validation in the signaling parser.

Vulnerable Code (Conceptual):

// Vulnerable: No bounds checking on input length
void process_signaling_message(char *message) {
    char buffer[1024];
    // Direct copy without validation
    strcpy(buffer, message);
    // ... further processing
}

Patched Code (Conceptual):

// Patched: Input validation and bounds checking
void process_signaling_message(char *message) {
    char buffer[1024];
    // Validate input length
    if (strlen(message) >= sizeof(buffer)) {
        log_error("Invalid message length");
        return;
    }
    // Safe copy
    strncpy(buffer, message, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\0';
    // ... further processing
}

The patch likely adds checks for message size, field format, and expected values, rejecting any malformed packets before they can cause a crash.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Objective: Trigger a denial of service on a Pexip Infinity instance (version 33.0 to 37.0).

Prerequisites:

• Network access to the Pexip Infinity signaling port (typically TCP/UDP 5060 for SIP, or proprietary ports).
• Knowledge of the target IP address.

Exploitation Steps:

1. Reconnaissance: Identify the Pexip Infinity version. This can sometimes be done via banner grabbing on the web interface or by analyzing SIP responses.

   nmap -sV -p 5060 <target_ip>
   

2. Craft Malformed Packet: Use a tool like scapy (Python) or sipsak to send a malformed SIP message. The exact malformation is unknown, but common techniques include:

   • Oversized headers.
   • Invalid characters in the From or To fields.
   • Missing required headers.
   • Recursive or deeply nested message bodies.

   Example using Python/scapy (conceptual):

   from scapy.all import *
   from scapy.contrib.sip import SIP
   
   # Craft a malformed SIP INVITE with an oversized header
   malformed_invite = SIP(method="INVITE", uri="sip:attacker@target.com")
   malformed_invite.add_field("X-Malformed", "A" * 10000)  # Oversized header
   
   send(IP(dst="<target_ip>")/UDP(sport=5060, dport=5060)/malformed_invite)
   

3. Execute Attack: Send the malformed packet to the target. If successful, the Pexip Infinity signaling service will crash, causing a denial of service.

Expected Outcome: All active conferences are dropped. New connection attempts fail. The service may automatically restart, but the attack can be repeated.

Blue Team (Defense & Detection)

Objective: Detect and mitigate the attack.

Detection:

• Monitor for sudden spikes in malformed SIP messages.
• Alert on signaling process crashes or restarts.
• Use network intrusion detection systems (NIDS) to flag anomalous SIP traffic.

Mitigation:

• Immediate: Apply the vendor patch (upgrade to version 37.1 or later).
• Temporary: Restrict network access to the signaling port using firewall rules. Only allow trusted IPs.
• Long-term: Implement a Web Application Firewall (WAF) or Session Border Controller (SBC) that can inspect and sanitize signaling traffic.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusually large SIP packets (e.g., > 1500 bytes).
  • SIP packets with malformed headers (e.g., excessive length, invalid characters).
  • Repeated connection attempts from a single IP to the signaling port.
  • Logs showing "software abort" or "segmentation fault" in the signaling process.

• System IOCs:

  • Unexpected restart of the Pexip Infinity signaling service.
  • Core dump files generated by the signaling process.
  • High CPU or memory usage immediately before the crash.

• Log Examples:

  [ERROR] Signaling process crashed: signal 11 (SIGSEGV)
  [WARN] Malformed SIP message received from 192.168.1.100:5060
  

Detection Engineering

YARA Rule

rule CVE_2025_32096_Pexip_Signaling_DoS {
    meta:
        description = "Detects malformed SIP packets targeting Pexip Infinity signaling DoS"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-32096"
    strings:
        $sip_method = "INVITE" nocase
        $sip_method2 = "REGISTER" nocase
        $sip_method3 = "OPTIONS" nocase
        $long_header = /X-[A-Za-z0-9-]+:\s{0,100}[A-Za-z0-9]{500,}/
        $invalid_chars = /[^\x20-\x7E\r\n]/
    condition:
        any of ($sip_method*) and
        (any of ($long_header) or any of ($invalid_chars))
}

Sigma Rule

title: Pexip Infinity Signaling DoS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2025-32096 via malformed SIP packets
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        app_protocol: sip
        sip.method: 
            - "INVITE"
            - "REGISTER"
            - "OPTIONS"
        sip.header|contains: 
            - "X-"
        sip.header|length: >= 500
    condition: selection
falsepositives:
    - Legitimate but unusual SIP implementations
level: high

Suricata Rule

alert udp any any -> any 5060 (msg:"CVE-2025-32096 Pexip Infinity Signaling DoS Attempt"; content:"INVITE"; offset:0; depth:6; content:"X-"; within:100; pcre:"/X-[A-Za-z0-9-]+:\s{0,100}[A-Za-z0-9]{500,}/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action:

   • Upgrade all Pexip Infinity instances to version 37.1 or later. This is the only complete fix.
   • If immediate patching is not possible, restrict network access to the signaling port (e.g., TCP/UDP 5060) to only trusted IP addresses using firewall rules.

2. Compensating Controls:

   • Deploy a Session Border Controller (SBC) or SIP-aware firewall that can inspect and sanitize signaling traffic.
   • Enable rate limiting on the signaling port to mitigate rapid attack attempts.
   • Monitor logs for signs of exploitation (see IOCs).

3. Long-Term Hardening:

   • Implement network segmentation to isolate Pexip Infinity from untrusted networks.
   • Regularly review and update firewall rules.
   • Subscribe to Pexip security advisories for future patches.

4. Verification:

   • After patching, verify the version is 37.1 or later via the admin interface.
   • Test the signaling service by sending legitimate SIP messages to ensure functionality.

Valters IT – Securing Digital Frontiers