Burk Technology ARC Solo Missing Authentication Vulnerability Allowing Unauthorized Password Changes

A vulnerability exists in Burk Technology ARC Solo devices running versions prior to 1.0.62, where the password change mechanism can be exploited without proper authentication. This flaw allows an attacker to send a password change request directly to the device's HTTP endpoint without valid credentials. The system fails to enforce adequate authentication or session validation, enabling unauthorized password changes and potential takeover of the device.

Impact

Exploitation of this vulnerability could lead to unauthorized access to the device, allowing an attacker to change the password, lock out authorized users, or disrupt normal operations.

Remediation

Users are advised to update their ARC Solo devices to version 1.0.62 or later. The update can be downloaded from the Burk Technology website.