TeleMessage Vulnerabilities and Affected Products
Vulnerabilities associated with TM SGNL.
Products
Clear product- TM SGNL8 vulnerabilities
- service7 vulnerabilities
- archiving backend2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
smarsh telemessage Cleartext Storage of Sensitive Information in MemoryThe TeleMessage service through 2025-05-05 stores certain cleartext information in memory, even though memory content may be accessible to an adversary through various avenues. CWE-316May 28, 2025 | CVSS2.8v3.1 | EPSS0.115% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2025-48927MEDIUM | TeleMessage TM SGNL Initialization of a Resource with an Insecure Default VulnerabilityThe TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025. CWE-1188May 28, 2025 | CVSS5.3v3.1 | EPSS9.07% | PoCs0 | SignalsListed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-48926MEDIUM | smarsh telemessage Authentication Bypass Using an Alternate Path or ChannelThe admin panel in the TeleMessage service through 2025-05-05 allows attackers to discover usernames, e-mail addresses, passwords, and telephone numbers. CWE-288May 28, 2025 | CVSS4.3v3.1 | EPSS0.216% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-48928MEDIUM | TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere VulnerabilityThe TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025. | CVSS4.0v3.1 | EPSS0.408% | PoCs0 | SignalsListed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-48925MEDIUM | smarsh telemessage Use of Password Hash Instead of Password for AuthenticationThe TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to do MD5 hashing, and then accepts the hash as the authentication credential. CWE-836May 28, 2025 | CVSS4.3v3.1 | EPSS0.233% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-48929MEDIUM | smarsh telemessage Insecure Storage of Sensitive InformationThe TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token with a short expiration time) that can be reused at a later date if discovered by an adversary. | CVSS4.0v3.1 | EPSS0.282% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-47730MEDIUM | smarsh telemessage Use of Hard-coded CredentialsThe TeleMessage archiving backend through 2025-05-05 accepts API calls (to request an authentication token) from the TM SGNL (aka Archive Signal) app with the credentials of logfile for the user and enRR8UVVywXYbFkqU#QDPRkO for the password. CWE-798May 8, 2025 | CVSS4.8v3.1 | EPSS0.37% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
TeleMessage TM SGNL Hidden Functionality VulnerabilityThe TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessage "End-to-End encryption from the mobile phone through to the corporate archive" documentation, as exploited in the wild in May 2025. CWE-912May 8, 2025 | CVSS1.9v3.1 | EPSS0.428% | PoCs0 | SignalsListed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |