CVE-2025-13316
Published: 19 November 2025
Description
Twonky Server 8.5.2 on Linux and Windows is vulnerable to a cryptographic flaw, use of hard-coded cryptographic keys. An attacker with knowledge of the encrypted administrator password can decrypt the value with static keys to view the plain text password…
more
and gain administrator-level access to Twonky Server.
Mitigating Controls (NIST 800-53 r5)AI
Requires secure establishment and management of cryptographic keys, directly preventing the use of hard-coded static keys that enable decryption of the administrator password.
Mandates identification, reporting, and correction of system flaws like this hard-coded key vulnerability, enabling timely patching to block exploitation.
Requires vulnerability scanning that would identify the cryptographic flaw involving hard-coded keys in Twonky Server.
Security SummaryAI
Twonky Server version 8.5.2 on Linux and Windows is affected by CVE-2025-13316, a cryptographic vulnerability involving the use of hard-coded cryptographic keys (CWE-321). This flaw enables decryption of the encrypted administrator password using static keys, exposing the plaintext password and potentially compromising the server's security.
A remote attacker (AV:N, PR:N, UI:N) with knowledge of the encrypted administrator password can exploit this over the network, though it requires high attack complexity (AC:H). Successful exploitation allows the attacker to obtain the plaintext administrator password, granting full administrator-level access to Twonky Server and resulting in high impacts to confidentiality, integrity, and availability (CVSS:3.1 score of 8.1; C:H/I:H/A:H).
The Rapid7 advisory (https://www.rapid7.com/blog/post/cve-2025-13315-cve-2025-13316-critical-twonky-server-authentication-bypass-not-fixed/) details this issue alongside CVE-2025-13315 as a critical authentication bypass in Twonky Server that has not been fixed.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability involves hard-coded keys in a public-facing Twonky Server, enabling remote unauthenticated attackers to decrypt administrator passwords (exploitation of public-facing application for credential access).