CVE-2025-13315
BaseFortify
Publication date: 2025-11-19
Last updated on: 2025-12-02
Assigner: Rapid7, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lynxtechnology | twonky_server | 8.5.2 |
| linux | linux_kernel | * |
| microsoft | windows | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-420 | The product protects a primary channel, but it does not use the same level of protection for an alternate channel. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Twonky Server 8.5.2 on Linux and Windows allows an unauthenticated attacker to bypass the web service API authentication controls. By exploiting this access control flaw, the attacker can leak a log file that contains the administrator's username and encrypted password.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to sensitive information such as the administrator's username and encrypted password. This could potentially allow attackers to further compromise the system, escalate privileges, or gain control over the server.