CVE-2025-13316
BaseFortify
Publication date: 2025-11-19
Last updated on: 2025-11-25
Assigner: Rapid7, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lynxtechnology | twonky_server | 8.5.2 |
| linux | linux_kernel | * |
| microsoft | windows | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-321 | The product uses a hard-coded, unchangeable cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Twonky Server 8.5.2 on Linux and Windows involves the use of hard-coded cryptographic keys. An attacker who knows the encrypted administrator password can use these static keys to decrypt it, revealing the plain text password and allowing them to gain administrator-level access to the server.
How can this vulnerability impact me? :
If exploited, this vulnerability allows an attacker to obtain the administrator password in plain text and gain full administrative access to the Twonky Server. This could lead to unauthorized control over the server, potential data exposure, and manipulation of server functions.