CVE-2025-5095
Published: 08 August 2025
Summary
CVE-2025-5095 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Burk Technology ARC (inferred from references). Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 41.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-5 (Authenticator Management).
Deeper analysis
CVE-2025-5095 affects Burk Technology's ARC Solo device, where the password change mechanism lacks proper authentication procedures. An attacker can send a password change request directly to the device's HTTP endpoint without providing valid credentials, as the system does not enforce authentication or session validation, allowing the change to proceed unverified. This vulnerability, associated with CWE-306 (Missing Authentication for Critical Function), carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-08-08.
The vulnerability enables remote exploitation over the network by any unauthenticated attacker with access to the device's HTTP endpoint and low attack complexity, requiring no user interaction or privileges. Successful exploitation allows the attacker to change the device's password, effectively taking over the device and achieving high impacts on confidentiality, integrity, and availability.
Mitigation guidance is available in CISA ICS Advisory ICSA-25-219-03 at https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-03 and on the Burk Technology ARC Solo product page at https://www.burk.com/products/Broadcast/ARC-Solo-6.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-24000
Vulnerability details
Burk Technology ARC Solo's password change mechanism can be utilized without proper authentication procedures, allowing an attacker to take over the device. A password change request can be sent directly to the device's HTTP endpoint without providing valid credentials. The…
more
system does not enforce proper authentication or session validation, allowing the password change to proceed without verifying the request's legitimacy.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication on public HTTP password-change endpoint directly enables remote exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires enforcement of approved authorizations for access to system resources, directly preventing unauthenticated password changes via the HTTP endpoint.
Mandates protection of authenticator content from unauthorized modification, addressing the lack of authentication in the password change mechanism.
Establishes authentication and controls for remote access mechanisms like the device's exposed HTTP endpoint used for password changes.