VULNERABILITY INTELLIGENCE

CVE-2025-66573

CVSS score7.5 HIGH
EPSS probability0.30%
CISA KEVNot currently listed
Published2025-12-04
Last modified2026-10-18
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

Solstice Pod API (version 5.5, 6.2) contains an unauthenticated API endpoint (`/api/config`) that exposes sensitive information such as the session key, server version, product details, and display name. Unauthorized users can extract live session information by accessing this endpoint without authentication.

Weakness classification

  • disclosure@vulncheck.com: CWE-319

Primary references