What is CVE-2025-5095?

CVE-2025-5095 is a critical-severity vulnerability in Burk Technology Arc Solo, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2025-08-08.

How severe is CVE-2025-5095?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2025-5095 known to be exploited?

4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Burk Technology Arc Solo

CVE-2025-5095

Burk Technology ARC Solo's password change mechanism can be utilized without proper authentication procedures, allowing an attacker to take over the device. A password change request can be sent directly to the device's HTTP endpoint without providing valid credentials. The system does not enforce proper authentication or session validation, allowing the password change to proceed without verifying the request's legitimacy.

Vulnerability class: Broken Authentication

EPSS: 0.009 (56.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Burk Technology Arc Solo — versions 0

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2025-5095?: CVE-2025-5095 is a critical-severity vulnerability in Burk Technology Arc Solo, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2025-08-08.
How severe is CVE-2025-5095?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2025-5095 known to be exploited?: 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.