Security readout for executives and security teams
Plain-English summary
Certain Mersive Solstice Pod API versions can expose live session information to anyone who can reach the API. The disclosed data includes a session key and product details. This is most urgent where Pods are reachable from untrusted networks, guest Wi-Fi, or the internet.
Executive priority
Prioritize review for any exposed meeting-room or collaboration networks. Business risk is unauthorized access to live session data, which may support misuse of active Solstice sessions. Urgency is moderate unless exposed to the internet or broad guest networks.
Technical view
The source bundle describes an unauthenticated Solstice Pod API configuration endpoint exposing session key, server version, product details, and display name in versions 5.5 and 6.2. The CVE is scored CVSS 4.0 6.9 and mapped to CWE-319, though the described issue is sensitive data exposure without authentication.
Likely exposure
Exposure is most likely for Solstice Pods running 5.5 or 6.2 with API access reachable beyond trusted administration networks. The CVE record lists other versions as unaffected by default, so broader product impact should not be assumed from the provided evidence.
Exploitation context
An Exploit-DB reference is listed, indicating public exploit information exists. The bundle marks KEV as false and includes no cited evidence of active exploitation. Treat this as publicly documented but not confirmed exploited in the wild from the supplied sources.
Researcher notes
Evidence is limited to the CVE bundle, Exploit-DB reference, product documentation, and VulnCheck advisory. No patch version is named in the supplied data. Validate exposure defensively and avoid assuming additional affected versions, impact paths, or active exploitation.
Mitigation direction
- Restrict Solstice Pod API access to trusted management networks only.
- Block untrusted access from guest Wi-Fi and the public internet.
- Check Mersive guidance for fixed versions or vendor-approved mitigations.
- Upgrade only according to confirmed Mersive remediation guidance.
- Monitor logs for unexpected configuration API access.
Validation and detection
- Inventory Solstice Pods and record software versions.
- Identify Pods running versions 5.5 or 6.2.
- Confirm whether API access is reachable from untrusted networks.
- Review access logs for unauthenticated configuration endpoint requests.
- Verify vendor documentation for current remediation status.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-319: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-66573 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
6.9MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-52104CVE reference, VulnCheck · exploit
- Mersive HomepageCVE reference, VulnCheck · product
- Solstice DocumentationCVE reference, VulnCheck · product
- https://www.vulncheck.com/advisories/solstice-pod-api-session-key-extraction-via-api-endpointCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cleartext Transmission of Sensitive Information
Cleartext Transmission of Sensitive Information represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.