CVE-2025-66573

Solstice Pod API (version 5.5, 6.2) contains an unauthenticated API endpoint (`/api/config`) that exposes sensitive information such as the session key, server version, product details, and display name. Unauthorized users can extract live session information by accessing this endpoint without authentication.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://documentation.mersive.com/en/solstice/about-solstice.html	Product
https://www.exploit-db.com/exploits/52104	Exploit Third Party Advisory
https://www.mersive.com/	Product
https://www.vulncheck.com/advisories/solstice-pod-api-session-key-extraction-via-api-endpoint	Third Party Advisory
https://www.exploit-db.com/exploits/52104	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:mersive:solstice_pod_firmware:5.6:::::::*
	cpe:2.3:o:mersive:solstice_pod_firmware:6.2:::::::*

cpe:2.3:h:mersive:solstice_pod:-:*:*:*:*:*:*:*

History

18 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) La API de Solstice Pod (versión 5.5, 6.2) contiene un endpoint de API no autenticado ('/api/config') que expone información sensible como la clave de sesión, la versión del servidor, los detalles del producto y el nombre de visualización. Los usuarios no autorizados pueden extraer información de sesión en vivo accediendo a este endpoint sin autenticación.

Information

Published : 2025-12-04 21:16

Updated : 2026-10-18 15:10

NVD link : CVE-2025-66573

Mitre link : CVE-2025-66573

CVE.ORG link : CVE-2025-66573

JSON object : View

Products Affected

mersive

solstice_pod
solstice_pod_firmware

CWE

CWE-319

Cleartext Transmission of Sensitive Information

{"id": "CVE-2025-66573", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66573", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-05T17:52:11.355912Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "mersive", "product": "Solstice Pod API", "versions": [{"status": "affected", "version": "5.5"}, {"status": "affected", "version": "6.2"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-04T21:16:10.083", "references": [{"url": "https://documentation.mersive.com/en/solstice/about-solstice.html", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/52104", "tags": ["Exploit", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.mersive.com/", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/solstice-pod-api-session-key-extraction-via-api-endpoint", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/52104", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-319"}]}], "descriptions": [{"lang": "en", "value": "Solstice Pod API (version 5.5, 6.2) contains an unauthenticated API endpoint (`/api/config`) that exposes sensitive information such as the session key, server version, product details, and display name. Unauthorized users can extract live session information by accessing this endpoint without authentication."}, {"lang": "es", "value": "La API de Solstice Pod (versi\u00f3n 5.5, 6.2) contiene un endpoint de API no autenticado ('/api/config') que expone informaci\u00f3n sensible como la clave de sesi\u00f3n, la versi\u00f3n del servidor, los detalles del producto y el nombre de visualizaci\u00f3n. Los usuarios no autorizados pueden extraer informaci\u00f3n de sesi\u00f3n en vivo accediendo a este endpoint sin autenticaci\u00f3n."}], "lastModified": "2026-10-18T15:10:00.097", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:mersive:solstice_pod_firmware:5.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F813116A-47F5-47EC-9206-F51C4C73C60C"}, {"criteria": "cpe:2.3:o:mersive:solstice_pod_firmware:6.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8634D879-8398-468E-BBD4-9154686700ED"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:mersive:solstice_pod:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2208F1E1-4F8B-416E-B46C-40A8E862B55B"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "disclosure@vulncheck.com"}