Critical · published August 8, 2025
🚨 A password change that doesn't check who's asking? That's what Burk Technology ARC Solo is serving up! 🔥 It's like a hotel letting anyone swap the room key without verifying they're actually a guest — just stroll in and take over! If an attacker exploits this vulnerability, they could easily change the device's password and lock the legitimate user out, effectively taking control of the device. This could lead to unauthorized access to sensitive operations or data, putting users at immediate risk.
It's like a hotel letting anyone swap the room key without verifying they're actually a guest — just stroll in and take over! This vulnerability arises from the lack of proper authentication on the password change endpoint of the Burk Technology ARC Solo, allowing any request to change the password without validating the sender's identity.
If an attacker exploits this vulnerability, they could easily change the device's password and lock the legitimate user out, effectively taking control of the device. This could lead to unauthorized access to sensitive operations or data, putting users at immediate risk. To secure your device, immediately patch to the latest firmware version that addresses this flaw. Additionally, implement strong authentication measures and ensure session validation is enforced on all sensitive endpoints. Don't wait! You've got this! Follow these steps, and you'll be back in control in no time. 🛡️