PT-2025-47496 · Plex · Twonky Server

Published 2025-11-19 · Updated 2025-12-06 · CVE-2025-13315

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Twonky Server versions 8.5.2

Description An unauthenticated attacker can bypass web service API authentication controls to access a log file and retrieve the administrator's username and encrypted password. The issue involves a flaw in access control. The API authentication controls can be bypassed, allowing unauthorized access to sensitive information. The vulnerable API endpoint is not explicitly specified. The username and password of the administrator are exposed in the log file.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

Weakness Enumeration

CWE-420

Related Identifiers

CVE-2025-13315

Affected Products

Twonky Server

References · 15

• 🔥 https://rapid7.com/blog/post/cve-2025-13315-cve-2025-13316-critical-twonky-server-authentication-bypass-not-fixed · Exploit
• https://osv.dev/vulnerability/CVE-2025-13315 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13315 · Security Note
• https://twitter.com/CVEnew/status/1991409472254718435 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1pafq0u/top_10_trending_cves_30112025 · Reddit Post
• https://twitter.com/piedpiper1616/status/1994667272926081077 · Twitter Post
• https://twitter.com/tdatwja/status/1993990352525775359 · Twitter Post
• https://twitter.com/0dayPublishing/status/1991203550202900842 · Twitter Post
• https://twitter.com/dailycve/status/1995940062086025469 · Twitter Post
• https://t.me/cveNotify/144539 · Telegram Post
• https://reddit.com/r/CVEWatch/comments/1pb9z0k/top_10_trending_cves_01122025 · Reddit Post
• https://reddit.com/r/SecOpsDaily/comments/1pf82w9/metasploit_wrapup_12052025 · Reddit Post
• https://twitter.com/zoomeye_team/status/1994378735878062393 · Twitter Post
• https://twitter.com/PurpleOps_io/status/1994074114198274519 · Twitter Post
• https://twitter.com/not2cleverdotme/status/1997219473665769944 · Twitter Post