CVE-2025-13315
Lynxtechnology Twonky Server 8.5.2
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-13315 is a critical-severity Unprotected Alternate Channel (CWE-420) vulnerability in Lynxtechnology Twonky Server. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Fallback Channels (T1008); ranked in the top 2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-8 (Transmission Confidentiality and Integrity) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-13315 is an access control vulnerability (CWE-420) affecting Twonky Server version 8.5.2 on both Linux and Windows platforms. The flaw enables an unauthenticated attacker to bypass authentication controls in the web service API, leading to the leakage of a log file that exposes the administrator's username and encrypted password. Published on 2025-11-19, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical due to its high impact on confidentiality, integrity, and availability.
Any unauthenticated attacker with network access to the affected Twonky Server instance can exploit this vulnerability remotely with low attack complexity and no privileges or user interaction required. Exploitation involves bypassing the web service API authentication to access and read the log file, yielding the administrator's credentials. This initial foothold could facilitate further attacks, such as authentication with the leaked credentials or escalation depending on the server's configuration.
The primary advisory reference is a Rapid7 blog post detailing CVE-2025-13315 alongside CVE-2025-13316 as critical Twonky Server authentication bypass issues that have not been fixed: https://www.rapid7.com/blog/post/cve-2025-13315-cve-2025-13316-critical-twonky-server-authentication-bypass-not-fixed/. Security practitioners should isolate affected instances, monitor for log file access attempts, and seek vendor updates, as no patches are indicated in available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-198189
Vulnerability Data
Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Transmission confidentiality and integrity requirements apply to all transmitted data, preventing weaker protection on secondary channels.
Information flow enforcement requires consistent authorization and control over every path, directly stopping unequal protection of alternate channels.
Boundary protection mandates monitoring and control at all external and key internal interfaces, eliminating unprotected alternate channels.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Protecting all data-in-transit directly mitigates unequal channel protection though the control addresses broader transit scenarios.
Network protection from unauthorized access inherently requires securing every channel, not just primaries.
Network monitoring can surface use of unprotected alternate channels but does not prevent the design flaw.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Access restrictions may cover primary paths but leave alternate channels unprotected unless explicitly extended.
Secure authentication applies to primary channels but does not ensure alternate channels receive the same strength.
Network security controls ensure all channels receive equivalent protection, directly addressing unprotected alternate channels.
Security of network services requires consistent protection across all service channels, mitigating alternate-channel weaknesses.
Network segregation can reduce exposure of alternate channels but does not guarantee equivalent protection levels.
Cryptography can protect alternate channels but does not address the policy of applying equal protection across channels.