Description
Burk Technology ARC Solo's password change mechanism can be utilized without proper
authentication procedures, allowing an attacker to take over the device.
A password change request can be sent directly to the device's HTTP
endpoint without providing valid credentials. The system does not
enforce proper authentication or session validation, allowing the
password change to proceed without verifying the request's legitimacy.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Burk Technology | ARC Solo | < 1.0.62 | 1.0.62 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
TeteuXD2/CVE-2025-5095-POC ★ 0 · Sep 9, 2025
Python POC for CVE-2025-5095
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- ICSA-25-219-03 Burk Technology ARC Solo CISA ICS & IT advisories · Aug 7, 2025