vendor:
Solstice Pod
by:
The Baldwin School Ethical Hackers
4.1
CVSS
MEDIUM
Information Disclosure
200
CWE
Product Name: Solstice Pod
Affected Version From: 5.5
Affected Version To: 6.2
Patch Exists: NO
Related CWE:
CPE: a:mersive:solstice_pod:5.5 cpe:/a:mersive:solstice_pod:6.2
Platforms Tested: Windows 10, macOS, Linux
2025
Solstice Pod API Session Key Extraction via API Endpoint
The exploit leverages an unauthenticated API endpoint (/api/config) on the Solstice Pod to extract sensitive information like the session key, server version, product details, and display name. Attackers can retrieve live session data by accessing this endpoint without proper authentication.
Mitigation:
To mitigate this vulnerability, restrict access to the API endpoint (/api/config) and ensure that proper authentication mechanisms are in place to prevent unauthorized information disclosure.
