CVE-2025-13315 Unauthenticated log access in Twonky Server
Unauthenticated attackers can bypass API authentication to access log files, exposing administrator credentials in Twonky Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-13315?
CVE-2025-13315 is a critical vulnerability in Lynxtechnology Twonky Server, published on 19 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password.
Weakness: CWE-420
Which versions are affected by CVE-2025-13315?
It affects 1 product.
Products include Lynxtechnology Twonky Server.
How do I fix CVE-2025-13315?
No fix has been published for CVE-2025-13315 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-13315 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-13315 exists.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in Lynxtechnology Twonky Server
Sources
Also known as GHSA-x96r-v3vc-578h.