Description
Twonky Server 是一款流媒体服务器软件，其 /nmc/rpc/log_getfile 接口存在信息泄露漏洞。攻击者可以通过未授权访问该接口获取敏感日志文件，可能导致敏感信息泄露。
Twonky Server /nmc/rpc/log_getfile 信息泄露漏洞（CVE-2025-13315）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-13315
https://www.rapid7.com/blog/post/cve-2025-13315-cve-2025-13316-critical-twonky-server-authentication-bypass-not-fixed/
https://juejin.cn/post/7598480413804216362
https://www.siteguarding.com/security-blog/critical-authentication-bypass-vulnerabilities-in-twonky-server-what-enterprise-security-teams-need-to-know-about-cve-2025-13315-and-cve-2025-13316/
https://github.com/advisories/GHSA-x96r-v3vc-578h
https://cyberpress.org/twonky-server-critical-vulnerabilities/
https://advisories.checkpoint.com/defense/advisories/public/2025/cpai-2025-4802.html
https://cybersecuritynews.com/twonky-server-vulnerabilities/
https://pentest-tools.com/vulnerabilities-exploits/twonky-server-852-authentication-bypass-vulnerability-active-check_28205
https://noise.getoto.net/author/ryan-emmons/