# Burk Technology ARC Solo authentication bypass vulnerability

Published: 2025-08-07 · Severity: routine · Sectors: telecommunications, media
Canonical: https://vorant.io/reports/2628e281-3d5e-5904-a4ee-18c96d72e4b6/burk-technology-arc-solo-authentication-bypass-vulnerability

> Missing authentication in ARC Solo password-change function allows remote takeover without credentials.

Burk Technology's ARC Solo, a broadcast monitoring and control device, contains a critical authentication bypass vulnerability (CVE-2025-5095) in its HTTP password-change endpoint. An attacker can send a password-change request directly to the device without providing valid credentials; the system does not enforce authentication or session validation, allowing the request to proceed. Successful exploitation grants an attacker device access, enables account lockout of authorized users, and permits operational disruption. The vulnerability affects all ARC Solo versions prior to v1.0.62 and carries a CVSS v3 score of 9.8 and CVSS v4 score of 9.3, reflecting high exploitability—the attack is network-accessible, requires no user interaction, and demands no privileges. No active exploitation in the wild has been reported to CISA as of publication. The device is deployed worldwide across broadcast and communications infrastructure. Burk Technology has released patched version v1.0.62; administrators should prioritize upgrading and isolate devices from internet-facing networks and business network segments using firewalls and VPNs for any required remote access.

## Mentioned in this report

- Vulnerabilities: CVE-2025-5095

## Detection guidance (public sample)

### Unauthenticated HTTP Password Change Request Accepted by Web Service

ATT&CK: T1190

Detects a successful POST/PUT to a password-change style URI with no authenticated username in the web server log, the pattern of an authentication bypass in a device's password-change endpoint (CVE-2025-5095 class). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Unauthenticated HTTP Password Change Request Accepted by Web Service
id: 7406bb75-c11d-5ff4-ae5c-c9fba1882cbd
status: experimental
description: Detects successful HTTP POST/PUT requests to password-change style URIs
  where no authenticated user is recorded. Matches the behaviour of an authentication
  bypass in an embedded device's password-change endpoint (CVE-2025-5095 class), not
  a specific path. Tune the URI keywords to the device web UI in your environment.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-03
tags:
- attack.initial-access
- attack.t1190
- attack.t1078
logsource:
  category: webserver
detection:
  selection_request:
    cs-method:
    - POST
    - PUT
    cs-uri-stem|contains:
    - password
    - passwd
    sc-status:
    - 200
    - 201
    - 204
    - 302
  selection_noauth:
    cs-username:
    - '-'
    - null
  condition: selection_request and selection_noauth
falsepositives:
- Self-service password reset or first-time setup pages that legitimately accept unauthenticated
  password changes using a reset token
- Web servers that do not log the authenticated username, which makes every request
  appear unauthenticated
level: medium
author: Vorant
```

### External Source Posting to Password Change URI on Internal Device

ATT&CK: T1190

Detects HTTP POST requests to password-change style URIs from non-RFC1918 sources, indicating internet-originating attempts to reach device password-change endpoints such as the ARC Solo flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: External Source Posting to Password Change URI on Internal Device
id: 549d41df-065e-55d2-a37e-ab3aaa3df407
status: experimental
description: Detects HTTP POST requests containing password-change keywords in the
  URI that originate from public (non-private) source addresses. Management and control
  devices with unauthenticated password-change endpoints (CVE-2025-5095 class) should
  never receive these from the internet. Tune URI keywords to the environment.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-03
tags:
- attack.initial-access
- attack.t1190
- attack.t1199
logsource:
  category: proxy
detection:
  selection:
    cs-method: POST
    c-uri|contains:
    - password
    - passwd
  filter_internal:
    src_ip|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
  condition: selection and not filter_internal
falsepositives:
- Legitimate public web applications with user password change forms behind a reverse
  proxy
- Authorised remote administrators changing device passwords over VPN-less access
level: medium
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-03

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/2628e281-3d5e-5904-a4ee-18c96d72e4b6/burk-technology-arc-solo-authentication-bypass-vulnerability.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup