CVE-2025-66379

Executive Summary

CVE-2025-66379 is a high-severity denial-of-service (DoS) vulnerability affecting Pexip Infinity prior to version 39.0. The flaw resides in the media implementation component, where improper input validation allows a remote, unauthenticated attacker to trigger a software abort by sending a crafted media stream. This results in a complete denial of service, impacting the availability of the affected system. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time. However, the vulnerability is network-accessible and requires no authentication, making it a significant risk for unpatched deployments.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions or complex attack sequences are required.
• Privileges Required: None (PR:N) – The attacker does not need any authentication.
• User Interaction: None (UI:N) – No user action is needed for exploitation.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data is exposed.
• Integrity Impact: None (I:N) – No data is altered.
• Availability Impact: High (A:H) – The service is completely disrupted.

Threat Level: High. The ease of exploitation (network-based, no auth) combined with the high availability impact makes this a critical concern for any organization using Pexip Infinity. The lack of a public PoC reduces immediate risk, but the vulnerability is trivially discoverable through fuzzing of media streams.

Deep Dive & Mechanics

The vulnerability is rooted in improper input validation within Pexip Infinity's media processing pipeline. The software is designed to handle various real-time communication (RTC) media streams (e.g., RTP, SRTP, or proprietary formats). When a specially crafted media packet is received, the parsing logic fails to validate certain fields or boundaries correctly. This can lead to a buffer over-read, null pointer dereference, or an infinite loop, ultimately causing the media processing thread to abort.

Technical Walkthrough:

1. An attacker sends a malicious media stream to the target Pexip Infinity server on the standard media port (e.g., UDP 5004 for RTP).
2. The server's media handler receives the packet and passes it to the input validation routine.
3. Due to missing or insufficient checks on packet length, sequence numbers, or payload structure, the routine accesses memory outside the allocated buffer or enters an unexpected state.
4. This triggers a software abort (e.g., segmentation fault or assertion failure), crashing the media service.
5. The crash results in a denial of service for all active and new media sessions until the service is manually restarted or automatically recovered.

The vulnerability is classified under CWE-20 (Improper Input Validation), which encompasses failures to validate input data for correctness, completeness, or security.

Vulnerable vs. Patched Code

Since the exact source code is proprietary, the following is a conceptual representation of the vulnerable and patched logic.

Vulnerable Code (Pseudo-C):

void process_media_packet(uint8_t *packet, size_t len) {
    // No length check before accessing header
    uint16_t payload_type = (packet[0] << 8) | packet[1];
    // Assume payload starts at offset 12
    uint8_t *payload = packet + 12;
    size_t payload_len = len - 12; // Potential underflow if len < 12
    // Process payload without validation
    decode_payload(payload, payload_len);
}

Patched Code (Pseudo-C):

void process_media_packet(uint8_t *packet, size_t len) {
    // Validate minimum length
    if (len < 12) {
        log_error("Packet too short");
        return;
    }
    uint16_t payload_type = (packet[0] << 8) | packet[1];
    uint8_t *payload = packet + 12;
    size_t payload_len = len - 12;
    // Additional validation for payload type
    if (!is_valid_payload_type(payload_type)) {
        log_error("Invalid payload type");
        return;
    }
    decode_payload(payload, payload_len);
}

The patch adds a minimum length check and validates the payload type before processing, preventing the software abort.

Exploitation & Lab Setup

Red Team (Offensive)

Objective: Trigger a denial of service on a vulnerable Pexip Infinity instance.

Prerequisites:

• Target IP address and media port (default UDP 5004).
• Ability to send raw UDP packets.

Exploitation Steps:

1. Craft a Malformed RTP Packet: Use a tool like scapy or hping3 to send a malformed RTP packet. The key is to send a packet with a length field that causes an underflow or an invalid payload type.
2. Send the Packet: Transmit the crafted packet to the target's media port.
3. Verify DoS: Attempt to initiate a legitimate media session. If the service is down, the connection will fail.

Example using Scapy (Python):

from scapy.all import *
import struct

# Craft a malformed RTP packet (e.g., invalid length)
# RTP header: V=2, P=0, X=0, CC=0, M=0, PT=0, sequence=1, timestamp=0, SSRC=0
rtp_header = struct.pack('!BBHII', 0x80, 0, 1, 0, 0)
# Send a packet with only 4 bytes (causes underflow)
malformed_packet = rtp_header[:4]
send(IP(dst="TARGET_IP")/UDP(sport=12345, dport=5004)/Raw(load=malformed_packet))

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Defensive)

Detection:

• Monitor for sudden spikes in malformed RTP packets.
• Use network intrusion detection systems (NIDS) to flag packets with invalid RTP header fields.
• Enable logging on Pexip Infinity to capture crash dumps.

Mitigation:

• Immediately upgrade to Pexip Infinity 39.0 or later.
• If patching is not possible, restrict network access to the media ports (UDP 5004) to trusted IP addresses only.
• Implement rate limiting on media streams to reduce the impact of a DoS attack.

Indicators of Compromise (IOCs)

• Network IOCs:
  • UDP packets to port 5004 with invalid RTP header lengths (e.g., less than 12 bytes).
  • Packets with payload type values outside the standard range (0-127).
  • Repeated connection attempts from a single IP to the media port.
• System IOCs:
  • Crash logs in Pexip Infinity indicating a software abort in the media handler.
  • Service logs showing "Packet too short" or "Invalid payload type" errors (post-patch).
  • Unexpected restart of the media service.

Detection Engineering

YARA Rule

rule CVE_2025_66379_Malformed_RTP {
    meta:
        description = "Detects malformed RTP packets targeting CVE-2025-66379"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66379"
    strings:
        $rtp_header = { 80 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? }
        $short_packet = { 80 00 00 01 } // Example: minimal header
    condition:
        $rtp_header and #short_packet < 12
}

Sigma Rule

title: Detection of Malformed RTP Packets (CVE-2025-66379)
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects UDP packets to port 5004 with RTP header length less than 12 bytes.
author: Valters IT
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_port: 5004
        protocol: udp
        packet_length: < 12
    condition: selection
falsepositives:
    - Legitimate short packets (rare)
level: high

Suricata Rule

alert udp any any -> any 5004 (msg:"CVE-2025-66379 - Malformed RTP Packet Detected"; content:"|80|"; offset:0; depth:1; pktlen:<12; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Apply the vendor patch by upgrading to Pexip Infinity version 39.0 or later. This is the only definitive fix.
2. Network Segmentation: Restrict access to the media port (UDP 5004) to only trusted IP addresses using firewall rules.
3. Rate Limiting: Implement rate limiting on incoming media streams to mitigate DoS attempts.

Long-Term Measures:

• Enable comprehensive logging and monitoring for all media traffic.
• Conduct regular security assessments and fuzzing of media handling components.
• Subscribe to Pexip security advisories for future updates.

Workaround (if patching is delayed):

• Deploy a reverse proxy or load balancer that validates RTP packet structure before forwarding to the Pexip server.

Valters IT
Securing Digital Frontiers