Mersive vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Mersive products: 1 record(s), with severity, exploitation and fixes.

Solstice Pod Firmware 1 Solstice Pod API 1

Exploited only (KEV) →

CVE-2025-66573 High · 7.5 CWE-319 Dec 4, 2025

Solstice Pod API Session Key Extraction via API Endpoint

Solstice Pod API (version 5.5, 6.2) contains an unauthenticated API endpoint (`/api/config`) that exposes sensitive information such as the session key, server version, product details, and display name. Unauthorized users can extract live session information by accessing this endpoint without authentication.