PT-2025-32330 · Burk Technology · Arc Solo

Souvik Kandar · Published 2025-08-07 · Updated 2025-08-12 · CVE-2025-5095

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Burk Technology ARC Solo (affected versions not specified)

Description The password change mechanism in Burk Technology ARC Solo does not require proper authentication, potentially allowing an attacker to take over the device. A password change request can be sent directly to the device’s HTTP endpoint without valid credentials. The system lacks enforcement of authentication or session validation, enabling unauthorized password changes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-5095

Affected Products

Arc Solo

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-5095 · Security Note
• https://t.me/pentestingnews/66079 · Telegram Post
• https://twitter.com/zoomeye_team/status/1955091654622449716 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-25-219-03 · Note
• https://burk.com/products/Broadcast/ARC-Solo-6 · Note
• https://twitter.com/CVEnew/status/1953876889606520835 · Twitter Post
• https://twitter.com/CveFindCom/status/1953873847423205749 · Twitter Post
• https://t.me/CVEtracker/29527 · Telegram Post
• https://twitter.com/windowsforum/status/1953494678273249396 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1954724339280220257 · Twitter Post
• https://twitter.com/fridaysecurity/status/1954705104101081450 · Twitter Post