CVE•Published 2025-12-25•Modified 2026-10-07•1 article on news•5 live references•NVD data
CVE-2025-59683Pexip · Pexip_infinity
Vulnerability data via NVD (ingested)
CVSS v3.1
8.2
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
EPSS percentile
24
Exploit Prediction Scoring System · top 76% of all CVEs
Weaknesses (CWE)
Description
Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with Office 365 Legacy Exchange Tokens. This allows a remote attacker to read potentially sensitive data and excessively consume resources, leading to a denial of service.
Timeline
Published 2025-12-25
Modified 2026-10-07
External references
Search for exposed instances
Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).
Shodan · vuln tag0 hosts
vuln:CVE-2025-59683Hosts Shodan has explicitly fingerprinted as vulnerable.
Shodan · product
product:"Pexip Pexip Infinity"All exposed Pexip Pexip Infinity instances — cross-reference with the CVE's affected-version range.
Shodan · banner/body mention
http.html:"Pexip Infinity"HTTP body or banner mentions "Pexip Infinity" — catches deploys Shodan didn't identify as a product.
More intel sources (5)
Shodan report
vuln:CVE-2025-59683Country / ASN / product breakdown for the vuln query.
Censys
vulnerabilities.cve_id: CVE-2025-59683Censys host search filtered to this CVE id.
grep.app
CVE-2025-59683Public source-code mentions — fast PoC discovery.
GitHub code
CVE-2025-59683GitHub code search for direct mentions.
Google dork
"CVE-2025-59683" exploit -site:nvd.nist.govWrite-ups and news, NVD excluded.