Zero-Day Warning: Unpatched Twonky Server Flaws Expose Media to Total Takeover

A critical security warning has been issued for Twonky Server, a media server software, due to two severe vulnerabilities (CVE-2025-13315 and CVE-2025-13316) that allow hackers to bypass authentication and gain control of the server. The first flaw enables attackers to leak administrator credentials, while the second flaw allows them to decrypt these credentials using hardcoded keys. The vendor, Lynx Technology, has ceased communication and has not provided a fix, leaving users vulnerable. Users are advised to isolate their networks and assume their credentials are compromised.