PT-2021-11192 · Pexip · Pexip Infinity

Published 2021-07-07 · Updated 2021-07-10 · CVE-2020-25868

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Pexip Infinity versions 22.x through 24.x before 24.2

Description: The issue is related to improper input validation for call setup, allowing an unauthenticated remote attacker to trigger a software abort, resulting in a temporary loss of service.

Recommendations: For versions 22.x through 24.x before 24.2, update to version 24.2 or later to resolve the issue. At the moment, there is no other information about additional mitigation measures for this specific vulnerability.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-25868

Affected Products

Pexip Infinity

References · 5

• https://docs.pexip.com/admin/security_bulletins.htm · Vendor Advisory
• https://docs.pexip.com/admin/security_bulletins.htm#CVE-2020-25868 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25868 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25868 · Security Note
• https://t.me/cvenotify/17406 · Telegram Post