EXECUTIVE SUMMARY:
A critical authentication bypass vulnerability CVE-2025-5095 has been identified in ARC Solo broadcasting devices, with a high CVSS v3 score of 9.8, underscoring its severity. The issue stems from the device’s password-change feature, which fails to perform proper authentication or session validation—allowing attackers to submit password change requests over HTTP without any credentials and effectively take control of the device. Exploiting this flaw could enable unauthorized access, lock out legitimate administrators, and disrupt broadcasting operation.
RECOMMENDATION:
We recommend you update to ARC Solo v1.0.62 or later.
REFERENCES:
The following reports contain further technical details:
https://securityonline.info/cve-2025-5095-cvss-9-8-critical-flaw-in-arc-solo-broadcasting-devices-allows-unauthenticated-takeover/