CyberzSOC

Publication detail
← Back to advisories & guidance

ICSA-25-219-03: Burk Technology ARC Solo ↗ source

August 7, 2025 CISA ICS Advisory
Source: https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-03

Summary

Successful exploitation of this vulnerability could result in an attacker gaining access to the device, locking out authorized users, or disrupting operations. CVE-2025-5095: The device's password change mechanism can be utilized without proper authentication procedures, allowing an attacker to take over the device. A password change request can be sent directly to the device's HTTP endpoint without providing valid credentials. The system does not enforce proper authentication or session validation, allowing the password change to proceed without verifying the request's legitimacy.

Advisory Details CISA ICS CSAF feed

Advisory ID
ICSA-25-219-03
Status
Final · version 1
Initial release
2025-08-07
Last revised
2025-08-07
Vendor
Burk Technology
Critical infrastructure sectors
Communications
Deployed
Worldwide
Vendor headquarters
United States

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Credit: Souvik Kandar (MicroSec (microsec.io))

Affected products (1)
  • ARC Solo — <v1.0.62

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVEWeaknessCVSS v3Details
CVE-2025-5095 CWE-306 Missing Authentication for Critical Function 9.8 Critical The device's password change mechanism can be utilized without proper authentication procedures, allowing an attacker to take over the device. A password change request can be sent directly to the device's HTTP endpoint without providing valid credentials. The system does not enforce proper authentication or session validation, allowing the password change to proceed without verifying the request's legitimacy.

Vendor fix: Burk Technology recommends users update their ARC Solo devices to Version v1.0.62 or later. The upgrade can be downloaded from the Burk Technology website. ↗

Affected, fixed & timeline

Affected:

  • ARC Solo <v1.0.62

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVECVSSAffected
CVE-2025-5095 9.8 Critical Burk Technology ARC Solo Burk Technology ARC Solo's password change mechanism can be utilized without proper authentication procedures, allowing an attacker to take over the…

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

No KEV-catalogued vendors are named in this publication.