The vulnerability involves an unauthenticated API endpoint (/api/config) that returns sensitive data such as a session key, server version, product details, and display name. Exposing the session key can allow an attacker to hijack active sessions or forge authenticated requests, effectively compromising confidentiality and potentially enabling further malicious actions.

The affected product is Mersive Solstice Pod. Vulnerable firmware versions include 5.5 and 6.2; the description also mentions firmware 5.6, implying that earlier releases are at risk. All devices running these firmware versions are exposed.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers can reach the endpoint over the network, potentially without any preliminary authentication, making exploitation straightforward for anyone with network visibility to the device.