PT-2025-47496 · Plex · Twonky Server

Published 2025-11-19 · Updated 2025-11-29 · CVE-2025-13315

Positive Technologies · (AI Summary)

CVSS v4.0

9.3

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Twonky Server version 8.5.2

Description An unauthenticated attacker can bypass web service API authentication controls. This allows access to a log file containing the administrator's username and encrypted password. The affected software is Twonky Server version 8.5.2 running on Linux and Windows. The API authentication bypass allows unauthorized access to sensitive information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-420

Related Identifiers

CVE-2025-13315

Affected Products

Twonky Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-13315 · Security Note
• https://twitter.com/0dayPublishing/status/1991203550202900842 · Twitter Post
• https://twitter.com/zoomeye_team/status/1994378735878062393 · Twitter Post
• https://twitter.com/CVEnew/status/1991409472254718435 · Twitter Post
• https://twitter.com/tdatwja/status/1993990352525775359 · Twitter Post
• https://twitter.com/PurpleOps_io/status/1994074114198274519 · Twitter Post
• https://rapid7.com/blog/post/cve-2025-13315-cve-2025-13316-critical-twonky-server-authentication-bypass-not-fixed · Note
• https://twitter.com/piedpiper1616/status/1994667272926081077 · Twitter Post