CVE-2025-13315

The vulnerability results from an access control error (CWE-420 – incomplete or bypassed authentication path) in the Twonky Server web service API interface. An attacker without any credentials can send an appropriately crafted request to the API and bypass the required authentication mechanisms. As a result, it is possible to download a log file containing sensitive data – the administrator's username and encrypted password. The obtained data can be used for further attacks, e.g., password cracking attempts.

An attacker can gain unauthorized access to the application log file and read the administrator account name and encrypted password from it, which may lead to complete takeover of the administrative account.

According to information in the vendor references, the vulnerability has not been fixed (not fixed). It is recommended to monitor the vendor's website (Lynx Technology) for patch releases and track publications available at the indicated Rapid7 address. Until a fix is released, it is recommended to restrict network access to the Twonky Server web interface only to trusted hosts (e.g., using firewall or network rules) and avoid exposing the service on public network interfaces.

Twonky Server version 8.5.2 running on Linux and Windows systems.