How to fix CVE-2025-66573?

Within 24 hours: Identify all Solstice Pod instances running versions 5.5 or 6.2 and isolate them from untrusted networks; disable external API access if operationally feasible. Within 7 days: Implement network-level access controls (WAF rules, IP whitelisting) restricting /api/config endpoint access to authorized administrative networks only; rotate all session keys and credentials. Within 30 days: Upgrade to patched versions when available from vendor; conduct session audit logs to identify potential unauthorized access.

Is Solstice Pod Firmware affected by CVE-2025-66573?

An unauthenticated API endpoint in Solstice Pod versions 5.5 and 6.2 exposes critical session keys and system configuration data without requiring user credentials, allowing attackers to compromise active sessions and gain unauthorized system access.

CVE-2025-66573

EUVD-2025-201276 HIGH

2025-12-04 [email protected]

Information Disclosure Solstice Pod Firmware

7.5

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 16:35 euvd

EUVD-2025-201276

Analysis Generated

Mar 15, 2026 - 16:35 vuln.today

PoC Detected

Dec 23, 2025 - 00:09 vuln.today

Public exploit code

CVE Published

Dec 04, 2025 - 21:16 nvd

HIGH 7.5

DescriptionNVD

Solstice Pod API (version 5.5, 6.2) contains an unauthenticated API endpoint (/api/config) that exposes sensitive information such as the session key, server version, product details, and display name. Unauthorized users can extract live session information by accessing this endpoint without authentication.

AnalysisAI

Technical ContextAI

Information disclosure occurs when an application inadvertently reveals sensitive data to unauthorized actors through error messages, logs, or improper access controls. This vulnerability is classified as Cleartext Transmission of Sensitive Information (CWE-319).

RemediationAI

Implement proper access controls. Sanitize error messages in production. Review logging practices to avoid capturing sensitive data.

CVE-2025-66573 vulnerability details – vuln.today

Back

CVE-2025-66573

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code