Burk Technology ARC Solo authentication bypass vulnerability
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Missing authentication in ARC Solo password-change function allows remote takeover without credentials.
Burk Technology's ARC Solo, a broadcast monitoring and control device, contains a critical authentication bypass vulnerability (CVE-2025-5095) in its HTTP password-change endpoint. An attacker can send a password-change request directly to the device without providing valid credentials; the system does not enforce authentication or session validation, allowing the request to proceed. Successful exploitation grants an attacker device access, enables account lockout of authorized users, and permits operational disruption. The vulnerability affects all ARC Solo versions prior to v1.0.62 and carries a CVSS v3 score of 9.8 and CVSS v4 score of 9.3, reflecting high exploitability—the attack is network-accessible, requires no user interaction, and demands no privileges. No active exploitation in the wild has been reported to CISA as of publication. The device is deployed worldwide across broadcast and communications infrastructure. Burk Technology has released patched version v1.0.62; administrators should prioritize upgrading and isolate devices from internet-facing networks and business network segments using firewalls and VPNs for any required remote access.
Mentioned in this report
Detection guidance
Unauthenticated HTTP Password Change Request Accepted by Web Service
Detects a successful POST/PUT to a password-change style URI with no authenticated username in the web server log, the pattern of an authentication bypass in a device's password-change endpoint (CVE-2025-5095 class). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated HTTP Password Change Request Accepted by Web Service
id: 7406bb75-c11d-5ff4-ae5c-c9fba1882cbd
status: experimental
description: Detects successful HTTP POST/PUT requests to password-change style URIs
where no authenticated user is recorded. Matches the behaviour of an authentication
bypass in an embedded device's password-change endpoint (CVE-2025-5095 class), not
a specific path. Tune the URI keywords to the device web UI in your environment.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-03
tags:
- attack.initial-access
- attack.t1190
- attack.t1078
logsource:
category: webserver
detection:
selection_request:
cs-method:
- POST
- PUT
cs-uri-stem|contains:
- password
- passwd
sc-status:
- 200
- 201
- 204
- 302
selection_noauth:
cs-username:
- '-'
- null
condition: selection_request and selection_noauth
falsepositives:
- Self-service password reset or first-time setup pages that legitimately accept unauthenticated
password changes using a reset token
- Web servers that do not log the authenticated username, which makes every request
appear unauthenticated
level: medium
author: Vorant
External Source Posting to Password Change URI on Internal Device
Detects HTTP POST requests to password-change style URIs from non-RFC1918 sources, indicating internet-originating attempts to reach device password-change endpoints such as the ARC Solo flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: External Source Posting to Password Change URI on Internal Device
id: 549d41df-065e-55d2-a37e-ab3aaa3df407
status: experimental
description: Detects HTTP POST requests containing password-change keywords in the
URI that originate from public (non-private) source addresses. Management and control
devices with unauthenticated password-change endpoints (CVE-2025-5095 class) should
never receive these from the internet. Tune URI keywords to the environment.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-03
tags:
- attack.initial-access
- attack.t1190
- attack.t1199
logsource:
category: proxy
detection:
selection:
cs-method: POST
c-uri|contains:
- password
- passwd
filter_internal:
src_ip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
condition: selection and not filter_internal
falsepositives:
- Legitimate public web applications with user password change forms behind a reverse
proxy
- Authorised remote administrators changing device passwords over VPN-less access
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-03
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs