CVE-2020-35584: Mersive Solstice Pod Firmware

Medium severity, CVSS 5.9. EPSS: 0.8% chance of exploitation in the next 30 days.

In Solstice Pod before 3.0.3, the web services allow users to connect to them over unencrypted channels via the Browser Look-in feature. An attacker suitably positioned to view a legitimate user's network traffic could record and monitor their interactions with the web services and obtain any information the user supplies, including Administrator passwords and screen keys.

Affected products

• Mersive Solstice Pod Firmware: before 3.0.3 (fixed in 3.0.3)

Published 2020-12-23. Last modified 2026-06-17.