CVE-2025-66573 affects mersive Solstice Pod API versions 5.5 and 6.2. The vulnerability arises from an unauthenticated API endpoint (/api/config) that leaks sensitive data such as session keys and server details. Because this endpoint does not require authentication, attackers can retrieve live session information, potentially compromising confidentiality. The issue is categorized under CWE-319, indicating sensitive information is transmitted or exposed in cleartext. No known exploits are reported in the wild as of the publication date.

Unauthorized users can access sensitive session information and server details without authentication, potentially enabling further attacks or unauthorized access to live sessions. The exposure of session keys and product details could facilitate session hijacking or reconnaissance activities. However, there is no indication of direct system compromise or privilege escalation from this vulnerability alone.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is provided, restrict network access to the Solstice Pod API endpoints to trusted users only and consider implementing network-level controls such as firewalls or VPNs to limit exposure. Avoid exposing the API to untrusted networks.