CVE-2025-13315 — Unauthenticated log access in Twonky Server

CVE-2025-13315

Unauthenticated log access in Twonky Server PUBLISHED

Description (CNA)

Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password.

Affected (CNA)

Vendor / product	Versions
Lynxtechnology / Twonky Server	affected 8.5.2

CWE

CWE-420

References

https://www.rapid7.com/blog/post/cve-2025-13315-cve-2025-13316-critical-twonky-server-authentication-bypass-not-fixed/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.