CVE-2020-27523

Solstice-Pod up to 5.0.2 WEBRTC server mishandles the format-string specifiers %x; %p; %c and %s in the screen_key, display_name, browser_name, and operation_system parameter during the authentication process. This may crash the server and force Solstice-Pod to reboot, which leads to a denial of service.

• CWE-134

• https://documentation.mersive.com/content/topics/general-gen2i-pod-specs.htmProduct, Vendor Advisory
• https://tiger-team-1337.blogspot.com/2020/10/solstice-pod-critical-unauthenticated.htmlExploit, Third Party Advisory
• https://twitter.com/Kevin2600/status/1316261149403275264Third Party Advisory
• https://www.youtube.com/watch?v=EGW_M1MqAG0Exploit, Third Party Advisory
• https://documentation.mersive.com/content/topics/general-gen2i-pod-specs.htmProduct, Vendor Advisory
• https://tiger-team-1337.blogspot.com/2020/10/solstice-pod-critical-unauthenticated.htmlExploit, Third Party Advisory
• https://twitter.com/Kevin2600/status/1316261149403275264Third Party Advisory
• https://www.youtube.com/watch?v=EGW_M1MqAG0Exploit, Third Party Advisory

Published

Nov 11, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-27511An issue was discovered in the stripTags and unescapeHTML co…7.5
• CVE-2020-27514Directory Traversal vulnerability in delete function in admi…9.1
• CVE-2020-27515A Cross Site Scripting (XSS) vulnerability in Savsoft Quiz v…6.1
• CVE-2020-27518All versions of Windscribe VPN for Mac and Windows <= v2.02.…7.8
• CVE-2020-27519Pritunl Client v1.2.2550.20 contains a local privilege escal…7.8
• CVE-2020-2752Vulnerability in the MySQL Client product of Oracle MySQL (c…5.3
• CVE-2020-27524On Audi A7 MMI 2014 vehicles, the Bluetooth stack in Audi A7…7.1
• CVE-2020-2753Vulnerability in the Oracle Workflow product of Oracle E-Bus…5.3
• CVE-2020-27533A Cross Site Scripting (XSS) issue was discovered in the sea…5.4
• CVE-2020-27534util/binfmt_misc/check.go in Builder in Docker Engine before…5.3
• CVE-2020-27539Heap overflow with full parsing of HTTP respose in Rosteleco…9.8
• CVE-2020-2754Vulnerability in the Java SE, Java SE Embedded product of Or…3.7