CVE-2025-48929

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-48929
The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token with a short expiration time) that can be reused at a later date if discovered by an adversary.

4.0 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/ Press/Media Coverage
Configurations

Configuration 1 (hide)

cpe:2.3:a:smarsh:telemessage:*:*:*:*:*:*:*:*
History

22 Oct 2025, 15:01

Type Values Removed Values Added
CWE CWE-613
First Time Smarsh telemessage
Smarsh
References () https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/ - () https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/ - Press/Media Coverage
CPE cpe:2.3:a:smarsh:telemessage:*:*:*:*:*:*:*:*

01 Jul 2025, 20:15

Type Values Removed Values Added
Summary
  • (es) El servicio TeleMessage, hasta el 5 de mayo de 2025, implementa la autenticación a través de una credencial de larga duración (por ejemplo, no un token con un tiempo de vencimiento corto) que se puede reutilizar en una fecha posterior si un adversario la descubre, como se explotó en la naturaleza en mayo de 2025.
Summary (en) The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token with a short expiration time) that can be reused at a later date if discovered by an adversary, as exploited in the wild in May 2025. (en) The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token with a short expiration time) that can be reused at a later date if discovered by an adversary.

28 May 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-28 17:15

Updated : 2025-10-22 15:01

NVD link : CVE-2025-48929

Mitre link : CVE-2025-48929

CVE.ORG link : CVE-2025-48929

JSON object : View

Products Affected

smarsh

  • telemessage
CWE
CWE-922

Insecure Storage of Sensitive Information

CWE-613

Insufficient Session Expiration