Vulnerability Details CVE-2025-66573
Solstice Pod API (version 5.5, 6.2) contains an unauthenticated API endpoint (`/api/config`) that exposes sensitive information such as the session key, server version, product details, and display name. Unauthorized users can extract live session information by accessing this endpoint without authentication.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 14.0%
CVSS Severity
CVSS v3 Score 7.5
References
Products affected by CVE-2025-66573
-
cpe:2.3:h:mersive:solstice_pod:-
-
cpe:2.3:o:mersive:solstice_pod_firmware:5.6
-
cpe:2.3:o:mersive:solstice_pod_firmware:6.2