CVE-2020-35587
📋 TL;DR
This vulnerability allows attackers to easily decompile Solstice Pod firmware, revealing non-obfuscated source code. While not directly exploitable, it facilitates reverse engineering and attack development. Organizations using Solstice Pod collaboration devices before version 3.0.3 are affected.
💻 Affected Systems
- Mersive Solstice Pod
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could discover and exploit previously unknown vulnerabilities in the firmware, potentially gaining unauthorized access to the device or network.
Likely Case
Attackers analyze the code to understand device functionality, identify weaknesses, and develop targeted attacks against the system.
If Mitigated
With proper network segmentation and access controls, the impact is limited to information disclosure about device internals.
🎯 Exploit Status
While decompilation tools are publicly available, exploiting discovered vulnerabilities requires additional development work.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.3 and later
Vendor Advisory: https://documentation.mersive.com/content/pages/release-notes.htm
Restart Required: Yes
Instructions:
1. Log into Solstice Dashboard
2. Navigate to Pod Management
3. Select affected Pods
4. Click 'Update Firmware'
5. Select version 3.0.3 or later
6. Confirm and apply update
🔧 Temporary Workarounds
Network Segmentation
allIsolate Solstice Pods on separate VLANs with strict firewall rules
Physical Security Controls
allRestrict physical access to Pod devices to prevent local firmware extraction
🧯 If You Can't Patch
- Segment Solstice Pods on isolated network segments with strict access controls
- Implement network monitoring for unusual firmware access attempts
- Consider replacing with updated hardware if patching is impossible
🔍 How to Verify
Check if Vulnerable:
Check firmware version in Solstice Dashboard under Pod Management > Device DetailsCheck Version:
Not applicable - version check through web interface onlyVerify Fix Applied:
Confirm firmware version shows 3.0.3 or higher in the Solstice Dashboard📡 Detection & Monitoring
Log Indicators:
- Unusual firmware access attempts
- Multiple failed authentication attempts to Pod management interface
- Unexpected firmware update activity
Network Indicators:
- Unusual traffic patterns to/from Solstice Pods
- Port scanning targeting Pod management ports
- Traffic patterns consistent with firmware extraction
SIEM Query:
source="solstice-pod" AND (event_type="firmware_access" OR auth_failure_count>5)🔗 References
- https://attack.mitre.org/techniques/T1444/
- https://documentation.mersive.com/content/pages/release-notes.htm
- https://github.com/aress31/solstice-pod-cves
- https://www.mersive.com/uk/products/solstice/
- https://attack.mitre.org/techniques/T1444/
- https://documentation.mersive.com/content/pages/release-notes.htm
- https://github.com/aress31/solstice-pod-cves
- https://www.mersive.com/uk/products/solstice/
