How severe is CVE-2025-13315?

CVE-2025-13315 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2025-13315 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 32% (98th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-13315?

CVE-2025-13315 affects Lynxtechnology Twonky Server. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-13315?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2025-13315 have an EU (EUVD) identifier?

Yes. CVE-2025-13315 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-198189.

When was CVE-2025-13315 published?

CVE-2025-13315 was published on 2025-11-19 and last updated on 2026-06-17.

CVE-2025-13315

CVE-2025-13315 is a critical-severity vulnerability in Lynxtechnology Twonky Server with a CVSS 3.x base score of 9.8. Its EPSS exploit-prediction score of 32% places it in the 98th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-420.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v4: 9.3
EPSS exploit prediction: 32% (98th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-198189
Weakness: CWE-420
Affected product: Lynxtechnology Twonky Server
Published: 2025-11-19
Last modified: 2026-06-17

Description

Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password.

Frequently asked questions

What is CVE-2025-13315?: Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password.
How severe is CVE-2025-13315?: CVE-2025-13315 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-13315 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 32% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-13315?: CVE-2025-13315 affects Lynxtechnology Twonky Server. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-13315?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2025-13315 have an EU (EUVD) identifier?: Yes. CVE-2025-13315 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-198189.
When was CVE-2025-13315 published?: CVE-2025-13315 was published on 2025-11-19 and last updated on 2026-06-17.

References

https://www.rapid7.com/blog/post/cve-2025-13315-cve-2025-13316-critical-twonky-server-authentication-bypass-not-fixed/

Affected products (1)

cpe:2.3:a:lynxtechnology:twonky_server:8.5.2:*:*:*:*:*:*:*

More vulnerabilities in Lynxtechnology Twonky Server

CVE-2025-13316 — High (CVSS 8.1): Twonky Server 8.5.2 on Linux and Windows is vulnerable to a cryptographic flaw, use of hard-coded cryptographic keys.…
CVE-2018-7171 — High (CVSS 7.5): Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to share the contents of…
CVE-2018-9182 — Medium (CVSS 6.1): Twonky Server before 8.5.1 has XSS via a modified "language" parameter in the Language section.
CVE-2018-9177 — Medium (CVSS 6.1): Twonky Server before 8.5.1 has XSS via a folder name on the Shared Folders screen.
CVE-2018-7203 — Medium (CVSS 6.1): Cross-site scripting (XSS) vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to inject…

All CVEs affecting Lynxtechnology Twonky Server →

Other CWE-420 vulnerabilities

CVE-2023-20198 — Critical (CVSS 10.0): Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco…
CVE-2025-52921 — Critical (CVSS 9.9): In Innoshop through 0.4.1, an authenticated attacker could exploit the File Manager functions in the admin panel to…
CVE-2025-54309 — Critical (CVSS 9.0): CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation…
CVE-2025-54351 — High (CVSS 8.9): In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).
CVE-2026-40217 — High (CVSS 8.8): LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the…
CVE-2025-62001 — High (CVSS 8.8): BullWall Ransomware Containment supports configurable file and directory exclusions such as '$RECYCLE.BIN' to balance…

Browse all CWE-420 vulnerabilities →