CVE-2025-66573

Solstice Pod API Session Key Extraction via API Endpoint

Published Dec 4, 2025 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

Solstice Pod API (version 5.5, 6.2) contains an unauthenticated API endpoint (`/api/config`) that exposes sensitive information such as the session key, server version, product details, and display name. Unauthorized users can extract live session information by accessing this endpoint without authentication.

Analysis

Technical impact

The vulnerability involves an unauthenticated API endpoint (/api/config) that returns sensitive data such as a session key, server version, product details, and display name. Exposing the session key can allow an attacker to hijack active sessions or forge authenticated requests, effectively compromising confidentiality and potentially enabling further malicious actions.

Affected Systems

The affected product is Mersive Solstice Pod. Vulnerable firmware versions include 5.5 and 6.2; the description also mentions firmware 5.6, implying that earlier releases are at risk. All devices running these firmware versions are exposed.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers can reach the endpoint over the network, potentially without any preliminary authentication, making exploitation straightforward for anyone with network visibility to the device.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

mersive

Solstice Pod API

unaffected

Version	Status	Constraints
`5.5`	affected	—
`6.2`	affected	—

Configuration 1 [-]

AND

OR	cpe:2.3:o:mersive:solstice_pod_firmware:5.6:::::::*
	cpe:2.3:o:mersive:solstice_pod_firmware:6.2:::::::*

cpe:2.3:h:mersive:solstice_pod:-:*:*:*:*:*:*:*

No data.

Vendor	Product	Versions
Mersive	Solstice Pod	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest firmware update from Mersive to eliminate the exposure of the /api/config endpoint
If an update is not yet available, restrict network access to the Solstice Pod so that only trusted management addresses can reach the /api/config endpoint, or block the endpoint using a firewall or network ACL
Configure the device to require authentication for API calls or disable the unauthenticated API feature altogether

Generated by OpenCVE AI on April 22, 2026 at 20:57 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.322% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://documentation.mersive.com/en/solstice/about-solstice.html
https://www.exploit-db.com/exploits/52104
https://www.mersive.com/
https://www.vulncheck.com/advisories/solstice-pod-api-session-key-extraction-via-api-endpoint

History

Jul 14, 2026 10:45 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:h:mersive:solstice_pod:5.5:::::::* cpe:2.3:h:mersive:solstice_pod:6.2:::::::*

Dec 23, 2025 12:15 AM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Mersive solstice Pod Firmware
CPEs		cpe:2.3:h:mersive:solstice_pod:-:::::::* cpe:2.3:o:mersive:solstice_pod_firmware:5.6:::::::* cpe:2.3:o:mersive:solstice_pod_firmware:6.2:::::::*
Vendors & Products		Mersive solstice Pod Firmware
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

Dec 5, 2025 6:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Dec 5, 2025 11:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mersive Mersive solstice Pod
Vendors & Products		Mersive Mersive solstice Pod

Dec 4, 2025 9:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Solstice Pod API (version 5.5, 6.2) contains an unauthenticated API endpoint (`/api/config`) that exposes sensitive information such as the session key, server version, product details, and display name. Unauthorized users can extract live session information by accessing this endpoint without authentication.
Title		Solstice Pod API Session Key Extraction via API Endpoint
Weaknesses		CWE-319
References		https://documentation.mersive.com/en/solstice/about-solstice.html https://www.exploit-db.com/exploits/52104 https://www.mersive.com/ https://www.vulncheck.com/advisories/solstice-pod-api-session-key-extraction-via-api-endpoint
Metrics		cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}`