CVE-2025-13316 is a cryptographic flaw in Twonky Server 8.5.2 on both Linux and Windows, stemming from the use of hard-coded cryptographic keys. This vulnerability allows an attacker, with knowledge of the encrypted administrator password, to decrypt it and gain full administrative access to the server. The vulnerability carries a high CVSS score of 8.1, indicating a severe risk due to its network-based attack vector, high impact on confidentiality, integrity, and availability, and low attack complexity. Its EPSS score of 0.720090000 and FAUCET Risk Score of 99/100 further emphasize its critical nature. While not currently listed in CISA's KEV catalog, a Metasploit auxiliary module exists for a related authentication bypass, and there are 20 community mentions, suggesting active discussion and potential for exploit development.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
8.5.2CPE matchmatch criteria | cpe:2.3:a:lynxtechnology:twonky_server:8.5.2:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.