Vulnerabilities

CVE-2025-13315 is an access control flaw (CWE-420) in Twonky Server 8.5.2 on Linux and Windows that allows an unauthenticated remote attacker to bypass authentication on the server's web service API. By sending requests to the API without valid credentials, the attacker can read a server log file and retrieve the administrator's username and encrypted password, which could be cracked offline or used against the admin interface. Anyone running the affected Twonky Server build is exposed, and per Rapid7 (the assigning CNA) the flaw was not yet fixed at the time of disclosure. There is no confirmed in-the-wild exploitation and the issue is not in CISA KEV, but a public PoC exists and EPSS assigns a high 32.5% probability of exploitation within 30 days (98th percentile). The same Rapid7 advisory also covers companion issue CVE-2025-13316 in Twonky Server.

Do: Because Rapid7 reported the bug as not fixed at disclosure, monitor the Rapid7 advisory and Lynx Technology for a patched Twonky Server release and upgrade as soon as one is available. In the interim, restrict access to the Twonky web service API to trusted networks only (e.g., firewall rules limiting the default web port) and review access logs for unauthenticated API requests. Once patched, change the Twonky administrator password, since it may have been exposed in encrypted form, and review the same advisory for the companion CVE-2025-13316.

Twonky Server before 8.5.1 has XSS via a modified "language" parameter in the Language section.

Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to share the contents of arbitrary directories via a .. (dot dot) in the contentbase parameter to rpc/set_all.