CVE-2025-5095

CRITICAL

9.8

Descripcion

Burk Technology ARC Solo's password change mechanism can be utilized without proper authentication procedures, allowing an attacker to take over the device. A password change request can be sent directly to the device's HTTP endpoint without providing valid credentials. The system does not enforce proper authentication or session validation, allowing the password change to proceed without verifying the request's legitimacy.

Detalles CVE

Puntuacion CVSS v3.19.8

SeveridadCRITICAL

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado8/8/2025

Ultima modificacion8/8/2025

Fuentenvd

Avistamientos honeypot0

Debilidades (CWE)

CWE-306

Referencias

https://www.burk.com/products/Broadcast/ARC-Solo-6(ics-cert@hq.dhs.gov)

https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-03(ics-cert@hq.dhs.gov)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.