TeleMessage Archiving Backend up to 2025-05-05 wild backdoor

Summaryinfo

A vulnerability labeled as critical has been found in TeleMessage Archiving Backend up to 2025-05-05. This affects an unknown part of the component wild. Such manipulation leads to backdoor. This vulnerability is traded as CVE-2025-47729. An attack has to be approached locally. Furthermore, there is an exploit available. This product is provided as a managed service, meaning users do not have the ability to maintain vulnerability countermeasures themselves.

Detailsinfo

A vulnerability was found in TeleMessage Archiving Backend up to 2025-05-05. It has been rated as problematic. Affected by this issue is an unknown part of the component wild. The manipulation with an unknown input leads to a backdoor vulnerability. Using CWE to declare the problem leads to CWE-912. The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators. Impacted is confidentiality. CVE summarizes:

The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessage "End-to-End encryption from the mobile phone through to the corporate archive" documentation, as exploited in the wild in May 2025.

The advisory is shared for download at news.ycombinator.com. This vulnerability is handled as CVE-2025-47729 since 05/08/2025. The exploitation is known to be difficult. The attack needs to be approached locally. Additional levels of successful authentication are needed for exploitation. Technical details are unknown but an exploit is available. The MITRE ATT&CK project declares the attack technique as T1588.001.

It is declared as attacked. This issue was added on 05/12/2025 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 06/02/2025:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

This product is available as a managed service. Users are not able to maintain vulnerability countermeasures themselves.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-14003). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• TeleMessage

Name

• Archiving Backend

Version

• 2025-05-05

Managed Service

• yes

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion