Vulnerability record · CVE-2020-35587 · published 23 December 2020
CVE-2020-35587: Mersive solstice firmware missing encryption vulnerability
Mersive · Solstice Firmware
In Solstice Pod before 3.0.3, the firmware can easily be decompiled/disassembled. The decompiled/disassembled files contain non-obfuscated code. NOTE: it is unclear whether lack of obfuscation is directly associated with a negative impact, or instead only facilitates an attack technique
Description
In Solstice Pod before 3.0.3, the firmware can easily be decompiled/disassembled. The decompiled/disassembled files contain non-obfuscated code. NOTE: it is unclear whether lack of obfuscation is directly associated with a negative impact, or instead only facilitates an attack technique
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://attack.mitre.org/techniques/T1444/ | Third Party Advisory |
| https://documentation.mersive.com/content/pages/release-notes.htm | Release NotesVendor Advisory |
| https://github.com/aress31/solstice-pod-cves | Third Party Advisory |
| https://www.mersive.com/uk/products/solstice/ | ProductVendor Advisory |
| https://attack.mitre.org/techniques/T1444/ | Third Party Advisory |
| https://documentation.mersive.com/content/pages/release-notes.htm | Release NotesVendor Advisory |
| https://github.com/aress31/solstice-pod-cves | Third Party Advisory |
| https://www.mersive.com/uk/products/solstice/ | ProductVendor Advisory |
Track CVE-2020-35587 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-35587), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
