CVE-2025-47729

published 2025-05-08

CVE-2025-47729: The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different…

Priority P2 76 medium 4.9 CVSS 3.1

AV N AC L PR H UI N S U C H I N A N

KEV ITW

The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessage "End-to-End encryption from the mobile phone through to the corporate archive" documentation, as exploited in the wild in May 2025.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
telemessage	archiving_backend	<= 2025-05-05	—
telemessage	text_message_archiver	<= 2025-05-05	—

Detection & IOCs extracted from sources · hover to see the quote

• → TeleMessage TM SGNL (Archive Signal) app traffic to its archiving backend may expose cleartext message content — monitor for unencrypted message data in transit to TeleMessage archiving infrastructure ↗
• → Flag presence or use of the TeleMessage TM SGNL (Archive Signal) application on endpoints, as its archiving functionality contradicts vendor-stated E2E encryption claims and was exploited in the wild in May 2025 ↗
• → This is classified as a hidden functionality vulnerability — audit mobile device inventories and MDM/MAM solutions for the presence of TM SGNL / Archive Signal app installations ↗

CVSS provenance

nvd v3.1 4.9 MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vulncheck 1.9 LOW

cisa 4.9 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-912