Twonky Server Hard-Coded Cryptographic Keys Vulnerability Allowing Administrator Access

A vulnerability exists in Twonky Server version 8.5.2 on both Linux and Windows platforms, due to the use of hard-coded cryptographic keys. This flaw allows an attacker with knowledge of the encrypted administrator password to decrypt it using these static keys, thereby gaining administrator-level access to the server. Exploitation of this vulnerability could lead to unauthorized control over all media files stored on the server.

Impact

Exploitation of this vulnerability allows an attacker to decrypt the administrator password and gain full administrative access to the Twonky Server instance, including control over all media files stored on the server.

Reproduction

The vulnerability can be reproduced by first exploiting CVE-2025-13315, which involves bypassing authentication to access an API endpoint that leaks the encrypted administrator password. Once the encrypted password is obtained, it can be decrypted using the hard-coded keys to retrieve the plain text password, allowing access as an administrator.