CVE-2025-47729
Last modified
CVE-2025-47729 is a medium-severity vulnerability rated 4.9/10 on the CVSS scale. The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessage "End-to-End encryption from the mobile phone through to the corporate archive" documentation, as exploited in the wild in May 2025.. CISA has confirmed active exploitation in the wild. EPSS estimates a 0.39% chance of exploitation in the next 30 days.
Description
The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessage "End-to-End encryption from the mobile phone through to the corporate archive" documentation, as exploited in the wild in May 2025.
Metrics
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Telemessage | Text Message Archiver | <= 2025-05-05 |
References
- https://news.ycombinator.com/item?id=43909220Press/Media Coverage
- https://www.theregister.com/2025/05/05/telemessage_investigating/Press/Media Coverage
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47729US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-47729?
How severe is CVE-2025-47729?
How do I fix CVE-2025-47729?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-4772A vulnerability has been found in PHPGurukul Online Course R…9.8
- CVE-2025-47724Delta Electronics CNCSoft lacks proper validation of the use…7.3
- CVE-2025-47725Delta Electronics CNCSoft lacks proper validation of the use…7.3
- CVE-2025-47726Delta Electronics CNCSoft lacks proper validation of the use…7.3
- CVE-2025-47727Delta Electronics CNCSoft lacks proper validation of the use…7.3
- CVE-2025-47728Delta Electronics CNCSoft-G2 lacks proper validation of the …7.3
- CVE-2025-4773A vulnerability was found in PHPGurukul Online Course Regist…9.8
- CVE-2025-47730The TeleMessage archiving backend through 2025-05-05 accepts…7.5
- CVE-2025-47732Deserialization of untrusted data in Microsoft Dataverse all…9.8
- CVE-2025-47733Server-Side Request Forgery (SSRF) in Microsoft Power Apps a…7.5
- CVE-2025-47735inner::drop in inner.rs in the wgp crate through 0.2.0 for R…9.8
- CVE-2025-47736dialect/mod.rs in the libsql-sqlite3-parser crate through 0.…2.9
Are you affected by CVE-2025-47729?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST