Pexip Infinity vulnerabilities

CVE-2015-4719 [CRITICAL] CWE-269 CVE-2015-4719: The client API authentication mechanism in Pexip Infinity before 10 allows remote attackers to gain The client API authentication mechanism in Pexip Infinity before 10 allows remote attackers to gain privileges via a crafted request.

CVE-2025-59683 [CRITICAL] CWE-863 CVE-2025-59683: Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with Office 365 Legacy Exchange Tokens. This allows a remote attacker to read potentially sensitive data and excessively consume resources, leading to a denial of service.

CVE-2017-6551 [CRITICAL] CWE-20 CVE-2017-6551: Pexip Infinity before 14.2 allows remote attackers to cause a denial of service (service restart) or Pexip Infinity before 14.2 allows remote attackers to cause a denial of service (service restart) or execute arbitrary code via vectors related to Conferencing Nodes.

CVE-2020-11805 [CRITICAL] CWE-20 CVE-2020-11805: Pexip Reverse Proxy and TURN Server before 6.1.0 has Incorrect UDP Access Control via TURN. Pexip Reverse Proxy and TURN Server before 6.1.0 has Incorrect UDP Access Control via TURN.

CVE-2025-66377 [HIGH] CWE-306 CVE-2025-66377: Pexip Infinity before 39.0 has Missing Authentication for a Critical Function in a product-internal Pexip Infinity before 39.0 has Missing Authentication for a Critical Function in a product-internal API, allowing an attacker (who already has access to execute code on one node within a Pexip Infinity installation) to impact the operation of other nodes within the installation.

CVE-2022-27933 [HIGH] CVE-2022-27933: Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join. Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.

CVE-2022-26656 [HIGH] CVE-2022-26656: Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumera Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join.

CVE-2020-25868 [HIGH] CWE-20 CVE-2020-25868: Pexip Infinity 22.x through 24.x before 24.2 has Improper Input Validation for call setup. An unauth Pexip Infinity 22.x through 24.x before 24.2 has Improper Input Validation for call setup. An unauthenticated remote attacker can trigger a software abort (temporary loss of service).

CVE-2022-26655 [HIGH] CWE-20 CVE-2022-26655: Pexip Infinity 27.x before 27.3 has Improper Input Validation. The client API allows remote attacker Pexip Infinity 27.x before 27.3 has Improper Input Validation. The client API allows remote attackers to trigger a software abort via a gateway call into Teams.

CVE-2022-27936 [HIGH] CVE-2022-27936: Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via H.323. Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via H.323.

CVE-2022-27935 [HIGH] CVE-2022-27935: Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via Epic Telehealth. Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via Epic Telehealth.

CVE-2022-26657 [HIGH] CVE-2022-26657: Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join. Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.

CVE-2022-26654 [HIGH] CVE-2022-26654: Pexip Infinity before 27.3 allows remote attackers to force a software abort via HTTP. Pexip Infinity before 27.3 allows remote attackers to force a software abort via HTTP.

CVE-2022-27932 [HIGH] CVE-2022-27932: Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join. Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.

CVE-2022-32263 [HIGH] CVE-2022-32263: Pexip Infinity before 28.1 allows remote attackers to trigger a software abort via G.719. Pexip Infinity before 28.1 allows remote attackers to trigger a software abort via G.719.

CVE-2023-31289 [HIGH] CWE-20 CVE-2023-31289: Pexip Infinity before 31.2 has Improper Input Validation for signalling, allowing remote attackers t Pexip Infinity before 31.2 has Improper Input Validation for signalling, allowing remote attackers to trigger an abort.

CVE-2023-31455 [HIGH] CWE-20 CVE-2023-31455: Pexip Infinity before 31.2 has Improper Input Validation for RTCP, allowing remote attackers to trig Pexip Infinity before 31.2 has Improper Input Validation for RTCP, allowing remote attackers to trigger an abort.

CVE-2022-27931 [HIGH] CVE-2022-27931: Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via the Session Initi Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.

CVE-2022-27934 [HIGH] CVE-2022-27934: Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via HTTP. Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via HTTP.

CVE-2022-27928 [HIGH] CVE-2022-27928: Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via the Session Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.