CVE-2025-66573: Mersive Solstice Pod Firmware

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Solstice Pod API (version 5.5, 6.2) contains an unauthenticated API endpoint (`/api/config`) that exposes sensitive information such as the session key, server version, product details, and display name. Unauthorized users can extract live session information by accessing this endpoint without authentication.

Affected products

• Mersive Solstice Pod Firmware: version 5.6 only; version 6.2 only

Published 2025-12-04. Last modified 2026-06-17.