CVE-2025-13315 - CVE House
Back to Database
Status published Critical CVE-2025-13315

Unauthenticated log access in Twonky Server

Vulnerability Description

Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-13315

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Ryan Emmons, Staff Security Researcher at Rapid7

References

More from Lynxtechnology

View All →
CVE-2025-13316
Hard-coded encryption keys in Twonky Server
High 8.2

Affected Vendor

Lynxtechnology

View all reports →

Affected Software

Twonky Server
Vulnerable Versions:
8.5.2

Timeline

Official Publish: November 19th, 2025
Last Modified: November 19th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-420

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.