Actively exploited · Published May 8, 2025 · Assigned by mitre
CVE-2025-47729
Low 1.9 Exploited
In plain English
A low-severity security flaw in archiving backend from TeleMessage. Attackers are actively exploiting it in the wild (listed by CISA on May 12, 2025). The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Jun 2, 2025.
Official description
The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessage "End-to-End encryption from the mobile phone through to the corporate archive" documentation, as exploited in the wild in May 2025.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TeleMessage | archiving backend | 0 – through 2025-05-05 |
Weakness: CWE-912 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
References
- https://news.ycombinator.com/item?id=43909220
- https://arstechnica.com/security/2025/05/signal-clone-used-by-trump-official-stops-operations-after-report-it-was-hacked/
- https://www.theregister.com/2025/05/05/telemessage_investigating/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47729 government-resource