CVE-2025-48925

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-48925
The TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to do MD5 hashing, and then accepts the hash as the authentication credential.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/
Configurations

No configuration.

History

01 Jul 2025, 20:15

Type Values Removed Values Added
Summary
  • (es) El servicio TeleMessage hasta el 5 de mayo de 2025 depende del lado del cliente (por ejemplo, la aplicación TM SGNL) para realizar el hash MD5 y luego acepta el hash como credencial de autenticación, como se explotó en la naturaleza en mayo de 2025.
Summary (en) The TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to do MD5 hashing, and then accepts the hash as the authentication credential, as exploited in the wild in May 2025. (en) The TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to do MD5 hashing, and then accepts the hash as the authentication credential.

28 May 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-28 17:15

Updated : 2025-07-01 20:15

NVD link : CVE-2025-48925

Mitre link : CVE-2025-48925

CVE.ORG link : CVE-2025-48925

JSON object : View

Products Affected

No product.

CWE
CWE-836

Use of Password Hash Instead of Password for Authentication