CVE-2025-13315

CriticalCVSS 9.8

Published: 19/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

32.53%

98th percentile - higher than 98% of all known CVEs

Summary

Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password.

Risk Assessment

An attacker can obtain sensitive administrator credentials, potentially leading to full system compromise.

Recommendation

Upgrade Twonky Server to the latest version and restrict access to the API.

Other vulnerabilities in Twonky Server

CVE-2025-13316High
Twonky Server 8.5.2 on Linux and Windows uses hard-coded cryptographic keys. An attacker who knows the encrypted administrator password can decrypt it with static keys and gain administrator-level access to Twonky Server.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS