CVE-2025-13315 is a critical authentication bypass in Twonky Server 8.5.2 on Linux and Windows, scored 9.8 by CVSS 3.1. An unauthenticated attacker can reach a log file that exposes the administrator's username and encrypted password. Rapid7 reports that it is not patched, so restrict access and rotate credentials.
What's affected
Twonky Server 8.5.2, running on Linux and Windows. Rapid7, which reported the issue, tested it on Ubuntu 22.04 and Windows Server 2022, and describes 8.5.2 as the latest version available at the time of its post on 19 November 2025.
The weakness lets an unauthenticated remote attacker bypass the API authentication controls. Rapid7 describes this as a bypass of an earlier fix for a 2021 disclosure, where some administrator API endpoints remained reachable through an alternate routing path.
Rapid7 also reports a companion flaw, CVE-2025-13316, involving hardcoded encryption keys that are shared across installations. Together the two let an attacker who has the leaked encrypted password recover it and gain administrator access.
Rapid7 states that the vulnerabilities have not been patched. The vendor, Lynx Technology, acknowledged the report in August 2025 and then stopped responding, citing resource constraints. The Rapid7 post does not say whether the flaw is exploited in the wild, and the record does not mark it as a CISA Known Exploited Vulnerability.
How to check if you're exposed
Find out whether you run Twonky Server. It is built for media servers on embedded devices such as NAS boxes and some routers, so check network storage and home media gear as well as servers. Look at the version in the admin interface or the product's installation directory.
Then check exposure. Rapid7 reported about 850 Twonky Server services reachable from the internet at the time of its post. Scan your public addresses for the Twonky web ports from outside your network.
What to do now
- List every device and host running Twonky Server and its version.
- Remove it from the internet. Allow access only from trusted IP addresses, as Rapid7 advises.
- Assume the administrator password is exposed. Change it, and change it anywhere else it was used.
- Consider disabling or uninstalling the media server if you do not need it.
- Check the vendor site for a patched release, and read its notes before trusting any claim of a fix.
- Review the device for signs of unexpected administrator logins or changed settings.
- Keep the device on a separate network segment from sensitive systems.
Why it matters
The record classifies the flaw as CWE-420 (unprotected alternate channel). The service guards its administrator API, but an alternate path reaches the same functions without the check. A bypass of an earlier fix is a pattern worth noticing: the filter was patched at one path rather than the access control being enforced everywhere.
A score of 9.8 reflects network reach, no required privileges and high impact on confidentiality, integrity and availability. The lack of a patch is what makes it urgent, since the only mitigation is network control.
You can look up the entry in the Gold directory.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a fix for CVE-2025-13315?
Rapid7 says the flaw is not patched in 8.5.2 and that the vendor stopped responding. Check Twonky's own advisories for any later release.
Is CVE-2025-13315 exploited in the wild?
The sources used here do not say so, and the record does not set the CISA Known Exploited Vulnerabilities flag. Rapid7 notes about 850 exposed servers, so treat exposure as real.
Sources
- NVD record for CVE-2025-13315
- Rapid7: CVE-2025-13315 and CVE-2025-13316, Twonky Server authentication bypass, not fixed
Last reviewed: 19 October 2026.
