CVE-2025-47729

Published May 8, 2025

Last updated 2 months ago

TeleMessage

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-47729 is a vulnerability found in the TeleMessage TM SGNL application. The archiving backend of TeleMessage stores cleartext copies of messages from TM SGNL app users. This differs from the vendor's documentation, which describes "End-to-End encryption from the mobile phone through to the corporate archive". This vulnerability was exploited in the wild in May 2025. The vulnerability means that unauthorized individuals with high-privilege access could potentially view sensitive message contents in plaintext. This could compromise user privacy and corporate communication confidentiality because the messages were expected to be securely encrypted.

Description: The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessage "End-to-End encryption from the mobile phone through to the corporate archive" documentation, as exploited in the wild in May 2025.
Source: cve@mitre.org
NVD status: Analyzed
CNA Tags: exclusively-hosted-service

Risk scores

CVSS 3.1

Type: Primary
Base score: 4.9
Impact score: 3.6
Exploitability score: 1.2
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Severity: MEDIUM

Known exploits

Data from CISA

Vulnerability name: TeleMessage TM SGNL Hidden Functionality Vulnerability
Exploit added on: May 12, 2025
Exploit action due: Jun 2, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

cve@mitre.org: CWE-912
nvd@nist.gov: NVD-CWE-Other

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:telemessage:text_message_archiver:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9E704BA3-25AB-4F8F-93DD-96A824FD0E85",
            "versionEndIncluding": "2025-05-05"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.