PT-2025-20381 · Telemessage · Telemessage Archiving Backend+1

Matthew Green + 1 · Published 2025-05-08 · Updated 2025-05-20 · CVE-2025-47729

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TeleMessage versions prior to 2025-05-05

Description The TeleMessage archiving backend holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessage "End-to-End encryption from the mobile phone through to the corporate archive" documentation. This issue has been exploited in the wild in May 2025. The vulnerability allows unauthorized access to private messages and group chats that were intended to be secure, raising concerns about data security for individuals and government officials who use the application. It is estimated that a significant number of devices may be affected, including those used by high-ranking government officials and federal agencies.

Recommendations As a temporary workaround, consider disabling the use of the TeleMessage archiving backend until a patch is available. Restrict access to the TeleMessage application to minimize the risk of exploitation. Avoid using the TeleMessage application for sensitive communications until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Hidden Functionality

Weakness Enumeration

CWE-912

Related Identifiers

CVE-2025-47729

Affected Products

Tm Sgnl

Telemessage Archiving Backend

References · 20

• https://osv.dev/vulnerability/CVE-2025-47729 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-47729 · Security Note
• https://arstechnica.com/security/2025/05/signal-clone-used-by-trump-official-stops-operations-after-report-it-was-hacked · Note
• https://theregister.com/2025/05/05/telemessage_investigating · Note
• https://t.me/true_secator/7047 · Telegram Post
• https://twitter.com/fletch_ai/status/1922909865758126362 · Twitter Post
• https://twitter.com/twelvesec/status/1922296813429604850 · Twitter Post
• https://twitter.com/ScyScan/status/1922366654627069992 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1klihhb/cisa_alerts_on_serious_vulnerability_in · Reddit Post
• https://t.me/cvetracker/23355 · Telegram Post
• https://t.me/cvedetector/24825 · Telegram Post
• https://twitter.com/CISACyber/status/1921987340727140556 · Twitter Post
• https://twitter.com/CyberHub_blog/status/1922376847972507982 · Twitter Post
• https://twitter.com/DMFezzaReed/status/1921988999700222171 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47729 · Note