---

📋 Overview

CVE-2025-13315 is a critical access control flaw in Twonky Server 8.5.2 (Linux & Windows) discovered by Rapid7.

An attacker can access privileged RPC endpoints via an alternative routing path (/nmc/rpc/) that bypasses authentication checks. This allows leaking application log files containing the administrator's username and encrypted password.

Combined with CVE-2025-13316 (hardcoded Blowfish encryption keys), attackers can decrypt the credentials and gain full administrative control over the media server — including all stored media files.

⚠️ Important: The vendor (Lynx Technology) has stated that no patch is currently available.

---

🛠️ Vulnerability Details

Attribute	Details
CVE ID	CVE-2025-13315
Severity	Critical
CVSS v4.0 Score	9.3
Vector	AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H
Affected Product	Twonky Server 8.5.2
Platforms	Linux, Windows
Published	November 19, 2025
Patch Status	❌ Unpatched (No fix planned as of disclosure)

Root Cause

• Previous fixes only protected the /rpc/ endpoint.
• The /nmc/rpc/ prefix still allows unauthenticated access to sensitive endpoints like log_getfile.

---

🔥 Proof of Concept (PoC)

GET /nmc/rpc/log_getfile HTTP/1.1
Host: target.twonkyserver.local

This request returns application logs that contain lines similar to:

accessuser=admin
accesspwd=<encrypted_password>

The password can then be decrypted using the hardcoded Blowfish key (see CVE-2025-13316).

---

🧪 Exploitation Impact

• ✅ Leak admin username + encrypted password
• ✅ Decrypt credentials (paired with CVE-2025-13316)
• ✅ Full administrator login
• ✅ Complete control over all media files
• ✅ Remote server shutdown / reconfiguration
• ✅ Potential data exfiltration or ransomware deployment

---

🛡️ Mitigation & Recommendations

Since no official patch exists, follow these urgent steps:

1. Isolate the server — Place Twonky Server behind a strict reverse proxy or WAF.
2. Block vulnerable paths:
   • Block /nmc/rpc/log_getfile
   • Block all /nmc/rpc/ endpoints if possible
3. Use CrowdSec / WAF rules — Rules already exist for vpatch-CVE-2025-13315.
4. Change admin password to a strong unique value (if accessible).
5. Consider alternatives — Migrate to modern DLNA/UPnP media servers (e.g., Jellyfin, Plex, or Emby) that receive regular security updates.
6. Network segmentation — Never expose Twonky Server directly to the internet.

---

📚 References

• Rapid7 Official Advisory
• NVD Detail
• GitHub Advisory (GHSA-x96r-v3vc-578h)
• SiteGuarding Technical Analysis

---

📄 License

This repository is for educational and defensive security purposes only.

---