PT-2025-23113 · Unknown · Telemessage

Micah Lee · Published 2025-05-28 · Updated 2025-10-22 · CVE-2025-48930

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions TeleMessage service through 2025-05-05

Description The issue concerns the storage of certain cleartext information in memory by the TeleMessage service. This information may be accessible to an adversary through various means. There have been real-world incidents where this issue was exploited, specifically in May 2025.

Recommendations For the TeleMessage service through 2025-05-05, consider implementing memory encryption or secure data storage practices to protect sensitive information. As a temporary workaround, restrict access to sensitive data and monitor for any suspicious activity. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-316

Related Identifiers

CVE-2025-48930

Affected Products

Telemessage

References · 6

• https://osv.dev/vulnerability/CVE-2025-48930 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48930 · Security Note
• https://t.me/cveNotify/139851 · Telegram Post
• https://t.me/cvetracker/24841 · Telegram Post
• https://twitter.com/CVEnew/status/1927780487877017657 · Twitter Post
• https://wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes · Note