Critical Vulnerability in Burk ARC Solo: SQL Injection Threat to Broadcast Security

Burk Technology's ARC Solo—a mainstay in broadcast facility monitoring and control—has recently come under scrutiny following the disclosure of a critical vulnerability that exposes the device to remote exploitation. This revelation, denoted as CVE-2025-5095 and ranked at a critical 9.3 on the CVSS v4 scale, not only shakes confidence in operational security for broadcasters worldwide, but also highlights broader systemic risks for critical communications infrastructure.

Background​

ARC Solo devices, produced by Burk Technology—a U.S.-based company serving the global broadcast industry—are crucial for remotely monitoring and controlling broadcasting sites. With their widespread deployment across various communications sectors and geographies, these devices serve as digital nerve centers for critical operations. As reliance on remote and automated control continues to grow, the security integrity of such equipment has never been more paramount.
The disclosed vulnerability surfaced thanks to Souvik Kandar of MicroSec, who responsibly reported the issue to CISA. The flaw centers around a missing authentication check on an essential function: password changes. This security lapse allows attackers to bypass normal controls, altering the administrative password with a simple, unauthenticated HTTP request. In effect, a single well-crafted request could hand over control of these devices to unauthorized actors with minimal effort.

---

Anatomy of the Vulnerability​

Understanding the Flaw: Missing Authentication for Critical Function​

At its core, the vulnerability stems from a fundamental lapse in authentication enforcement. The ARC Solo’s password change functionality is exposed via an HTTP endpoint, but crucially, the endpoint fails to verify that incoming requests are properly authenticated. This is a textbook case of CWE-306 (“Missing Authentication for Critical Function”), wherein critical operations are exposed without sufficient checks, enabling simple but devastating exploits.
The consequences of this flaw are severe:

• Device Takeover: Malicious actors can change the device password, locking out legitimate users.
• Operational Disruption: Controllers can be rendered inoperative, potentially leading to outages or loss of critical monitoring functions.
• Persistence: Attackers retaining device access may hinder recovery efforts, escalate privilege, or use the device as a launchpad for further intrusions.

Technical and Scoring Details​

The vulnerability, tracked as CVE-2025-5095, affects all ARC Solo devices running firmware versions prior to v1.0.62. It is particularly alarming due to its:

• Remote Exploitability: No local access required; attacks can be conducted over the network.
• Low Attack Complexity: Requires no special conditions or high technical proficiency.
• No Privileges Required: Attackers need neither an account nor prior access.
• No User Interaction: No user needs to click a link or perform any action to trigger the exploit.

The vulnerability carries a CVSS v3 base score of 9.8 and a CVSS v4 base score of 9.3, both underscoring its critical nature. These scores reflect the potential for high severity impacts, including confidentiality, integrity, and availability violations.

---

Broadcast Infrastructure at Risk​

Communications Sector Impact​

Broadcast communication systems are indispensable for information dissemination, public safety, and real-time content delivery. With ARC Solo’s controlled endpoints often interconnected with studio automation systems, remote transmission sites, and sometimes even emergency services, the risk profile of such a vulnerability is amplified.

• Global Reach: ARC Solo devices are deployed worldwide, spanning national broadcasters to small regional studios.
• Critical Infrastructure: These systems underpin critical communications infrastructure that is expected to function securely and reliably, even during crises.

Precedents and Parallels​

This incident is not isolated. The increasing digitization and remote accessibility of industrial control devices have surfaced similar vulnerabilities across energy, transport, and communications networks. The lesson is clear: overlooked authentication on critical functions is a perennial danger that attackers are keen to exploit.

---

Risk Scenarios and Potential Impacts​

Possible Attack Chains​

A successful exploitation of CVE-2025-5095 can have cascading effects, particularly in environments where ARC Solo devices operate at the core of critical workflows.

• Broadcast Blackouts: Attackers can lock out engineers, silencing broadcasts or interfering with transmission controls.
• False Reporting: Tampering with device settings may result in falsified telemetry, undermining situational awareness.
• Pivot Points: Compromised devices may become beachheads for broader attacks on enterprise or operational networks.

Attack Surface Augmentation​

These risks are exacerbated when devices are exposed to the public Internet or insufficiently segmented from business operations. Despite longstanding guidance to the contrary, surveys and threat intelligence routinely uncover improperly secured broadcast and industrial control devices, enlarging the attack surface.

---

Vendor and CISA Response​

Patch Availability and Vendor Guidance​

Burk Technology has responded promptly, issuing an updated firmware (v1.0.62 or later) that corrects the authentication oversight. This patch closes the vulnerability by enforcing proper credential validation before processing critical commands, including password changes.
Users are strongly urged to:

• Update Immediately: Ensure all ARC Solo devices are updated to v1.0.62 or above.
• Download Securely: Obtain patches directly from the official Burk Technology website to avoid counterfeit or tampered updates.

Defensive Measures and Best Practices​

CISA, steeped in industrial cybersecurity leadership, echoes the following recommendations:

• Isolate Critical Controls: Place ARC Solo and similar devices behind robust firewalls. They should never be directly accessible from the open Internet.
• Limit Remote Access: Where remote connectivity is essential, employ up-to-date VPNs and multi-factor authentication, recognizing VPNs themselves can introduce risk if not well maintained.
• Monitor and Audit: Track device access and changes, looking for unexpected or unauthorized modifications.
• Implement Defense-in-Depth: Layer security controls, ensuring that failure in one area does not open the entire system to compromise.

CISA's broader corpus of advice underscores regular risk assessments, system hardening, tight network segmentation, and proactive patch management.

---

Critical Analysis​

Strengths in Disclosure and Response​

The incident’s handling exemplifies the strengths of coordinated vulnerability disclosure:

• Swift Reporting: Responsible disclosure by security researcher Souvik Kandar facilitated a rapid vendor response.
• Proactive Vendor Engagement: Burk Technology’s timely release of a firmware fix demonstrates responsible stewardship.
• Comprehensive Guidance: CISA’s advisory provides actionable direction, empowering organizations to remediate risk effectively.

This transparency minimizes the window of opportunity for malicious actors, equipping defenders with the knowledge and tools needed to secure vulnerable systems.

Ongoing Risks and Industry Weaknesses​

Despite the positive response, significant challenges persist—both within affected organizations and the broader ICS industry:

• Legacy Device Exposure: Not all organizations patch promptly, leaving outdated and vulnerable devices in production.
• Perimeter Complacency: Overreliance on legacy network segmentation leaves critical functions accessible due to misconfigurations or administrative oversight.
• Operational Constraints: In many broadcast environments, even brief downtime to apply patches is heavily scrutinized, delaying mitigation.
• Human Factors: Security guidance may be overlooked or misapplied amid operational pressures.

Moreover, while CISA reports no public exploitation of this specific vulnerability at the time of writing, "no evidence" does not equate to "no risk." Sophisticated threat actors may exploit gaps covertly, especially in high-value targets where the stakes for confidentiality, availability, and integrity are at their highest.

---

Lessons for the Future: Securing Industrial IoT​

The Authentication Imperative​

This incident crystallizes a lesson many in industrial control circles know well but sometimes still neglect: authentication must be mandatory for all critical actions. The convenience of automated, remote configuration must never come at the expense of foundational security. Vendors and customers alike should:

• Mandate Authentication: All management interfaces, APIs, and critical endpoints should enforce strong authentication.
• Design for Defense-in-Depth: Assume any control channel might eventually be discovered and attacked; multiple, redundant security checks are essential.
• Harden by Default: New devices must ship with secure defaults, including randomized passwords, enforced credential complexity, and locked-down APIs.

Continuous Vigilance and Proactive Defense​

The lifecycle of industrial devices can stretch for decades. Maintaining their security posture requires continual monitoring, periodic reassessment, and an organizational culture that values proactive defense.
Key actions:

• Asset Discovery: Maintain accurate inventories and monitor for unauthorized or unexpected systems on the network.
• Patch Management: Aggressively test and deploy security updates, particularly for high-impact flaws such as this.
• Threat Intelligence: Consume up-to-date advisories and threat feeds to stay ahead of evolving attack methods.

---

Conclusion​

The high-severity vulnerability in Burk Technology's ARC Solo is a stark reminder that even mature, widely trusted systems in critical communications infrastructure can harbor fundamental security oversights. While Burk Technology and CISA’s coordinated disclosure and remediation efforts set a high mark for responsible response, the onus remains on asset owners and operators to heed these warnings, update systems, and institute lasting safeguards.
As industrial control and broadcast environments continue to digitize and interconnect, only sustained vigilance, rigorous development practices, and a security-first mindset will ensure operational resilience in the face of evolving threats. The lesson for the sector is clear: every critical function, no matter how routine, must be fortified against exploitation. Anything less risks not just organizational disruption, but the integrity of the world's broadcast communications.

---

Source: CISA Burk Technology ARC Solo | CISA