CVE-2025-13316

HighCVSS 8.1

Published: 19/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.68%

86th percentile - higher than 86% of all known CVEs

Summary

Twonky Server 8.5.2 on Linux and Windows uses hard-coded cryptographic keys. An attacker who knows the encrypted administrator password can decrypt it with static keys and gain administrator-level access to Twonky Server.

Risk Assessment

Anyone with the encrypted administrator password can recover it in plain text and take administrative control of the Twonky Server.

Recommendation

Upgrade Twonky Server to a version that removes the hard-coded keys and change the administrator password after upgrading.

Other vulnerabilities in Twonky Server

CVE-2025-13315Critical
Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password.

Original NVD description (English source)

Twonky Server 8.5.2 on Linux and Windows is vulnerable to a cryptographic flaw, use of hard-coded cryptographic keys. An attacker with knowledge of the encrypted administrator password can decrypt the value with static keys to view the plain text password and gain administrator-level access to Twonky Server.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS