Threat Investigation
Request a demo

CVE-2025-5095

Critical

Description

Burk Technology ARC Solo's password change mechanism can be utilized without proper authentication procedures, allowing an attacker to take over the device. A password change request can be sent directly to the device's HTTP endpoint without providing valid credentials. The system does not enforce proper authentication or session validation, allowing the password change to proceed without verifying the request's legitimacy.

SeverityCritical
CVSS9.8
Exploit probability—
ProductARC Solo
PublishedAug 8, 2025
First seenAug 8, 2025
Weakness typeCWE-306Missing authentication for critical function

How to fix

Update
  • Burk Technology ARC Solo1.0.62 or later

Affected products

ProductAffected versionsFixed in
Burk Technology ARC Solov < 1.0.621.0.62

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.