CVE-2020-35584

MEDIUM

Mersive Solstice Pod Firmware < 3.0.3 - Cleartext Transmission

Title source: rule

Description

In Solstice Pod before 3.0.3, the web services allow users to connect to them over unencrypted channels via the Browser Look-in feature. An attacker suitably positioned to view a legitimate user's network traffic could record and monitor their interactions with the web services and obtain any information the user supplies, including Administrator passwords and screen keys.

References (3)

Core 3

Core References

Release Notes, Vendor Advisory x_refsource_misc

https://documentation.mersive.com/content/pages/release-notes.htm

Product, Vendor Advisory x_refsource_misc

https://www.mersive.com/uk/products/solstice/

Exploit, Third Party Advisory x_refsource_misc

https://github.com/aress31/solstice-pod-cves

View Exploit ZIP pw:eip

Scores

CVSS v3 5.9

EPSS 0.0018

EPSS Percentile 38.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-319

Status published

Products (1)

mersive/solstice_pod_firmware < 3.0.3

Published Dec 23, 2020

Tracked Since Feb 18, 2026