Vulnerability Description
The TeleMessage archiving backend through 2025-05-05 accepts API calls (to request an authentication token) from the TM SGNL (aka Archive Signal) app with the credentials of logfile for the user and enRR8UVVywXYbFkqU#QDPRkO for the password.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Smarsh | Telemessage | <= 2025-05-05 |
Related Weaknesses (CWE)
References
- https://arstechnica.com/security/2025/05/signal-clone-used-by-trump-official-stoPress/Media Coverage
- https://github.com/micahflee/TM-SGNL-Android/blob/bd7ccbb8bc79193fc4c57cae7cc105Product
- https://news.ycombinator.com/item?id=43909220Issue Tracking
- https://www.theregister.com/2025/05/05/telemessage_investigating/Press/Media Coverage
FAQ
What is CVE-2025-47730?
CVE-2025-47730 is a vulnerability with a CVSS score of 4.8 (MEDIUM). The TeleMessage archiving backend through 2025-05-05 accepts API calls (to request an authentication token) from the TM SGNL (aka Archive Signal) app with the credentials of logfile for the user and e...
How severe is CVE-2025-47730?
CVE-2025-47730 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-47730?
Check the references section above for vendor advisories and patch information. Affected products include: Smarsh Telemessage.