CVE-2020-35586 - In Solstice Pod before 3.3.0 (or Open4.3), the Administrator password can be enumerated using brute-force attacks via the /Config/service/initModel?password= Solstice Open Control API because there is no complexity requirement (e.g., it might be all digits or all lowercase letters)

Back Back to CVE browser

HIGH

In Solstice Pod before 3.3.0 (or Open4.3), the Administrator password can be enumerated using brute-force attacks via the /Config/service/initModel?password= Solstice Open Control API because there is no complexity requirement (e.g., it might be all digits or all lowercase letters)

Published Dec 23, 2020

7.5

HIGH

CVSS 3.1

EPSS 1.37%

Description

In Solstice Pod before 3.3.0 (or Open4.3), the Administrator password can be enumerated using brute-force attacks via the /Config/service/initModel?password= Solstice Open Control API because there is no complexity requirement (e.g., it might be all digits or all lowercase letters).

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-307

References (4)

https://documentation.mersive.com/content/pages/release-notes.htm
x_refsource_MISCRelease NotesVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-23252
Advisory
https://github.com/aress31/solstice-pod-cves
x_refsource_MISCExploitThird Party Advisory
https://www.mersive.com/uk/products/solstice/
x_refsource_MISCProductVendor Advisory

Link	Providers	Tags
https://documentation.mersive.com/content/pages/release-notes.htm		x_refsource_MISCRelease NotesVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-23252		Advisory
https://github.com/aress31/solstice-pod-cves		x_refsource_MISCExploitThird Party Advisory
https://www.mersive.com/uk/products/solstice/		x_refsource_MISCProductVendor Advisory