CVE-2025-13316 Hard-coded encryption keys in Twonky Server
Hard-coded encryption keys allow attackers to decrypt administrator passwords and gain full administrative access to Twonky Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-13316?
CVE-2025-13316 is a high-severity vulnerability in Lynxtechnology Twonky Server, published on 19 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Twonky Server 8.5.2 on Linux and Windows is vulnerable to a cryptographic flaw, use of hard-coded cryptographic keys. An attacker with knowledge of the encrypted administrator password can decrypt the value with static keys to view the plain text password and gain administrator-level access to Twonky Server.
Weakness: CWE-321
Which versions are affected by CVE-2025-13316?
It affects 1 product.
Products include Lynxtechnology Twonky Server.
How do I fix CVE-2025-13316?
No fix has been published for CVE-2025-13316 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-13316 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-13316 exists.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in Lynxtechnology Twonky Server
Sources
Also known as GHSA-6wjv-8p85-pcxm.