CVE-2020-35584 - CVE House
Back to Database
Status published Medium CVE-2020-35584

In Solstice Pod before 3.0.3, the web services allow users...

Vulnerability Description

In Solstice Pod before 3.0.3, the web services allow users to connect to them over unencrypted channels via the Browser Look-in feature. An attacker suitably positioned to view a legitimate user's network traffic could record and monitor their interactions with the web services and obtain any information the user supplies, including Administrator passwords and screen keys.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-35584

Credits & Attribution

No credits recorded in the NVD database.

References

More from mersive

View All →
CVE-2025-66573
Solstice Pod API Session Key Extraction via API Endpoint
Medium 6.9
CVE-2020-35587
In Solstice Pod before 3.0.3, the firmware can easily be...
High 7.5
CVE-2020-35586
In Solstice Pod before 3.3.0 (or Open4.3), the Administrator password...
High 7.5
CVE-2020-35585
In Solstice Pod before 3.3.0 (or Open4.3), the screen key...
High 7.5
CVE-2020-27523
Solstice-Pod up to 5.0.2 WEBRTC server mishandles the format-string specifiers...
High 7.5

Affected Vendor

Affected Software

solstice pod firmware
Vulnerable Versions:
0

Timeline

Official Publish: December 23rd, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.