The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessage "End-to-End encryption from the mobile phone through to the corporate archive" documentation, as exploited in the wild in May 2025.
References
| Link | Resource |
|---|---|
| https://arstechnica.com/security/2025/05/signal-clone-used-by-trump-official-stops-operations-after-report-it-was-hacked/ | Press/Media Coverage |
| https://news.ycombinator.com/item?id=43909220 | Press/Media Coverage |
| https://www.theregister.com/2025/05/05/telemessage_investigating/ | Press/Media Coverage |
Configurations
History
13 May 2025, 18:12
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:telemessage:text_message_archiver:*:*:*:*:*:*:*:* | |
| First Time |
Telemessage text Message Archiver
Telemessage |
|
| CWE | NVD-CWE-Other | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.9 |
| References | () https://news.ycombinator.com/item?id=43909220 - Press/Media Coverage | |
| References | () https://www.theregister.com/2025/05/05/telemessage_investigating/ - Press/Media Coverage | |
| References | () https://arstechnica.com/security/2025/05/signal-clone-used-by-trump-official-stops-operations-after-report-it-was-hacked/ - Press/Media Coverage |
08 May 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-08 14:15
Updated : 2025-05-14 13:12
NVD link : CVE-2025-47729
Mitre link : CVE-2025-47729
JSON object : View
Products Affected
telemessage
- text_message_archiver
CWE