Solstice-Pod up to 5.0.2 WEBRTC server mishandles the format-string specifiers %x; %p; %c and %s in the screen_key, display_name, browser_name, and operation_system parameter during the authentication process. This may crash the server and force Solstice-Pod to reboot, which leads to a denial of service.
References
| Link | Resource |
|---|---|
| https://documentation.mersive.com/content/topics/general-gen2i-pod-specs.htm | Product Vendor Advisory |
| https://tiger-team-1337.blogspot.com/2020/10/solstice-pod-critical-unauthenticated.html | Exploit Third Party Advisory |
| https://twitter.com/Kevin2600/status/1316261149403275264 | Third Party Advisory |
| https://www.youtube.com/watch?v=EGW_M1MqAG0 | Exploit Third Party Advisory |
| https://documentation.mersive.com/content/topics/general-gen2i-pod-specs.htm | Product Vendor Advisory |
| https://tiger-team-1337.blogspot.com/2020/10/solstice-pod-critical-unauthenticated.html | Exploit Third Party Advisory |
| https://twitter.com/Kevin2600/status/1316261149403275264 | Third Party Advisory |
| https://www.youtube.com/watch?v=EGW_M1MqAG0 | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 05:21
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://documentation.mersive.com/content/topics/general-gen2i-pod-specs.htm - Product, Vendor Advisory | |
| References | () https://tiger-team-1337.blogspot.com/2020/10/solstice-pod-critical-unauthenticated.html - Exploit, Third Party Advisory | |
| References | () https://twitter.com/Kevin2600/status/1316261149403275264 - Third Party Advisory | |
| References | () https://www.youtube.com/watch?v=EGW_M1MqAG0 - Exploit, Third Party Advisory |
Information
Published : 2020-11-11 15:15
Updated : 2024-11-21 05:21
NVD link : CVE-2020-27523
Mitre link : CVE-2020-27523
CVE.ORG link : CVE-2020-27523
JSON object : View
Products Affected
mersive
- solstice_pod_firmware
- solstice_pod
CWE
CWE-134
Use of Externally-Controlled Format String