Critical authentication bypass flaw in Burk Technology ARC Solo Devices
Take action: If you use Burk ARC Solo monitoring devices in your broadcasting facilities, make sure they are isolated from the internet and accessible from trusted networks only. Then plan an update them to version v1.0.62 or later, because it's fairly trivial to reset the device password and hijack the device.
Learn More
Burk Technology has addressed a critical vulnerability in its ARC Solo monitoring and control devices, which are primarily used in broadcasting facilities worldwide.
The vulnerability is tracked as CVE-2025-5095 (CVSS score 9.3), Missing Authentication for Critical Function. A password change request can be sent directly to the device's HTTP endpoint without providing valid credentials. The system does not enforce authentication or session validation, allowing the password change to proceed without verifying the request's legitimacy.
Successful exploitation of this vulnerability could result in an attacker gaining access to the device, locking out authorized users, or disrupting operations.
Burk Technology recommends users update their ARC Solo devices to Version v1.0.62 or later. The upgrade can be downloaded from the Burk Technology website.
Organizations operating ARC Solo devices should minimize network exposure for all control system devices, and ensure they are not accessible from the internet. Control system networks and remote devices should be located behind firewalls and isolated from business networks.
