Pexip Infinity WebRTC Direct Media Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Pexip Infinity versions 35.0 through 38.1, prior to 39.0. The issue arises in non-default configurations that enable Direct Media for WebRTC calls. The vulnerability is due to improper input validation in the signaling implementation, allowing an attacker to trigger a software abort, which temporarily disrupts service.

Impact

Exploitation of this vulnerability leads to a software abort, causing a temporary denial-of-service condition on the affected system.

Remediation

Users can upgrade to Pexip Infinity version 39.0 to address this vulnerability. For those using versions 35.0 to 38.1, Direct Media for WebRTC calls can be disabled on a per-conference basis by navigating to Services > Virtual Meeting Rooms, selecting the desired Virtual Meeting Room, and changing the Enable direct media option to Never.