CVE-2020-35584

The vulnerability affects Solstice Pod prior to version 3.0.3. The web services expose a Browser Look‑in feature that allows connections over unencrypted channels. An attacker positioned to observe legitimate user network traffic could monitor interactions with the web services and capture sensit...

CVE-2020-35586

Solstice Pod (before 3.3.0) and Solstice Open4.3 vulnerability where the Administrator password can be enumerated by brute-forcing the Open Control API endpoint /Config/service/initModel?password= due to no password complexity requirements. Affected products are Solstice Pod prior to 3.3.0 and So...

CVE-2020-35585

CVE-2020-35585 affects Solstice Pod before 3.3.0 (or Open4.3). A brute‑force enumeration flaw enables guessing the screen key via the /lookin/info Solstice Open Control API, with only ~1.7 million possibilities. This is the vulnerability described in the CVE; the connected documents confirm the A...