A critical authentication bypass in Burk Technology ARC Solo devices allows unauthenticated attackers to change administrative passwords and hijack the system.

The password change mechanism fails to perform proper authentication checks, allowing an unauthenticated remote attacker to submit a request to change the administrative password and gain full control.

The ability to reset the administrator password without authentication leads to a complete takeover of the broadcast control device. With a CVSS score of 9.8, the potential for service disruption, unauthorized broadcast manipulation, or persistent unauthorized access represents a critical business risk.

Immediate Action: Upgrade all ARC Solo devices to firmware version 1.0.62 or later immediately to enforce proper authentication for critical administrative functions.

Proactive Monitoring: Review device logs for unusual password change requests or unauthorized modifications to administrative settings.

Compensating Controls: Restrict network access to the ARC Solo management interface to trusted workstations and ensure the device is not accessible from the public internet.

Public Exploit Available: Yes — a public proof-of-concept repository exists on GitHub.

The presence of a public proof-of-concept makes this vulnerability highly urgent. Organizations utilizing Burk Technology ARC Solo devices must apply the version 1.0.62 update immediately to prevent potential device hijacking.