BaseFortify

Publication date: 2025-11-19

Last updated on: 2025-11-25

Assigner: Rapid7, Inc.

Description

Twonky Server 8.5.2 on Linux and Windows is vulnerable to a cryptographic flaw, use of hard-coded cryptographic keys. An attacker with knowledge of the encrypted administrator password can decrypt the value with static keys to view the plain text password and gain administrator-level access to Twonky Server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-19

Last Modified

2025-11-25

Generated

2026-07-06

AI Q&A

2025-11-19

EPSS Evaluated

2026-07-05

NVD

CVE-2025-13316

Affected Vendors & Products

Vendor	Product	Version / Range
lynxtechnology	twonky_server	8.5.2
linux	linux_kernel	*
microsoft	windows	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-321	The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

Executive Summary

This vulnerability in Twonky Server 8.5.2 on Linux and Windows involves the use of hard-coded cryptographic keys. An attacker who knows the encrypted administrator password can use these static keys to decrypt it, revealing the plain text password and allowing them to gain administrator-level access to the server.

Impact Analysis

If exploited, this vulnerability allows an attacker to obtain the administrator password in plain text and gain full administrative access to the Twonky Server. This could lead to unauthorized control over the server, potential data exposure, and manipulation of server functions.

Hi! I’m here to help you understand CVE-2025-13316. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70