CVE-2025-66573
📋 TL;DR
CVE-2025-66573 is an information disclosure vulnerability in Solstice Pod API that allows unauthenticated attackers to access sensitive configuration data including session keys. This affects Solstice Pod versions 5.5 and 6.2. Organizations using these versions for screen sharing and collaboration are at risk.
💻 Affected Systems
- Solstice Pod API
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could extract session keys and potentially hijack active sessions, impersonate legitimate users, or gain unauthorized access to shared content and administrative functions.
Likely Case
Unauthorized users will extract sensitive configuration information including session keys, server details, and product information, enabling reconnaissance for further attacks.
If Mitigated
With proper network segmentation and access controls, the exposed information would be limited to internal reconnaissance value only.
🎯 Exploit Status
Exploitation requires only HTTP GET requests to the vulnerable endpoint with no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.mersive.com/
Restart Required: No
Instructions:
Check Mersive vendor website for security updates. If no patch available, implement workarounds immediately.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict access to Solstice Pod API endpoints using firewall rules or network segmentation.
iptables -A INPUT -p tcp --dport [Solstice_Port] -s [Allowed_IP_Range] -j ACCEPT
iptables -A INPUT -p tcp --dport [Solstice_Port] -j DROP
Reverse Proxy Authentication
allPlace Solstice Pod behind a reverse proxy that requires authentication before accessing the API endpoints.
🧯 If You Can't Patch
- Isolate Solstice Pod systems on separate network segments with strict access controls
- Implement network monitoring and alerting for unauthorized access attempts to the /api/config endpoint
🔍 How to Verify
Check if Vulnerable:
Run: curl -X GET http://[Solstice_IP]:[Port]/api/config - if it returns configuration data without authentication, system is vulnerable.Check Version:
Check Solstice Pod web interface or documentation for version information.Verify Fix Applied:
After implementing controls, attempt the same curl command - it should return authentication error or be blocked.📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests to /api/config endpoint from unauthorized IP addresses
- Unusual access patterns to Solstice Pod API
Network Indicators:
- Unencrypted HTTP traffic containing session keys or configuration data
- External IP addresses accessing internal Solstice Pod endpoints
SIEM Query:
source="solstice.log" AND (uri="/api/config" OR method="GET" AND uri CONTAINS "api")