CVE-2025-49088
Improper Input Validation in Pexip OTJ Causes DoS
Publication date: 2025-12-25
Last updated on: 2025-12-25
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pexip | infinity | 37.1 |
| pexip | infinity | 32.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-617 | The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Pexip Infinity versions 32.0 through 37.1 before 37.2, specifically in certain configurations of the OTJ (One Touch Join) service for Teams SIP Guest Join. It involves improper input validation in the OTJ service, which allows a remote attacker to send a specially crafted calendar invite that triggers a software abort, causing a denial of service.
How can this vulnerability impact me? :
The vulnerability can lead to a denial of service condition by causing the affected software to abort when processing a maliciously crafted calendar invite. This means that the service could become unavailable or disrupted, impacting users relying on the OTJ feature for Teams SIP Guest Join.