Multiple Vulnerabilities in Twonky Server

Summary

Two vulnerabilities have been reported to affect earlier versions of Twonky Server.

• An improper access restriction vulnerability allows remote attackers to gain access to sensitive information, such as the administrator username and password for accessing Twonky Server settings.
• A weak password obfuscation vulnerability allows remote attackers to decrypt passwords easily.

Both vulnerabilities combined allow remote attackers to gain access to all content accessible to the server.

The vendor released version 8.5.2 to address the vulnerabilities.

Recommendation

To fix the vulnerability, we recommend updating Twonky Server to the latest version.

Updating Twonky Server

1. Log on to QTS as administrator.
2. Open the App Center and then click .
A search box appears.

3. Type “Twonky Server” and then press ENTER.
   Twonky Server appears in the search results.
4. Click Update.
   A confirmation message appears.
   Note: The Update button is not available if your Twonky Server is already up to date.
5. Click OK.
   The application is updated.

Reference:

Lynx Technology Twonky Server Multiple Vulnerabilities