BaseFortify

Publication date: 2025-11-19

Last updated on: 2025-12-02

Assigner: Rapid7, Inc.

Description

Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-19

Last Modified

2025-12-02

Generated

2026-07-06

AI Q&A

2025-11-19

EPSS Evaluated

2026-07-05

NVD

CVE-2025-13315

Affected Vendors & Products

Vendor	Product	Version / Range
lynxtechnology	twonky_server	8.5.2
linux	linux_kernel	*
microsoft	windows	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-420	The product protects a primary channel, but it does not use the same level of protection for an alternate channel.

Attack-Flow Graph

Executive Summary

This vulnerability in Twonky Server 8.5.2 on Linux and Windows allows an unauthenticated attacker to bypass the web service API authentication controls. By exploiting this access control flaw, the attacker can leak a log file that contains the administrator's username and encrypted password.

Impact Analysis

The vulnerability can lead to unauthorized access to sensitive information such as the administrator's username and encrypted password. This could potentially allow attackers to further compromise the system, escalate privileges, or gain control over the server.

Hi! I’m here to help you understand CVE-2025-13315. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70