CVE-2025-47729

LOW1.9

CISA KEV

Published 2025-05-08 · Updated 2026-06-17 · Source cve@mitre.org

Summary

CVE-2025-47729 is a low-severity (CVSS 1.9) vulnerability in TeleMessage TM SGNL. CISA added it to the Known Exploited Vulnerabilities catalog on May 12, 2025, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by June 2, 2025. CISA does not currently list it as used in ransomware campaigns. TeleMessage has 3 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.

All 3 known-exploited TeleMessage vulnerabilities →

Description

The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessage "End-to-End encryption from the mobile phone through to the corporate archive" documentation, as exploited in the wild in May 2025.

CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

CWE-912

CISA Known-Exploited Vulnerability

Product: TeleMessage — TM SGNL

Name: TeleMessage TM SGNL Hidden Functionality Vulnerability

Date added: 2025-05-12 · Due: 2025-06-02

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

References

View on NVD

More exploited TeleMessage vulnerabilities

Most recently added to CISA KEV

CVE-2025-48928
TM SGNL — TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability
added 2025-07-01
CVE-2025-48927
TM SGNL — TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability
added 2025-07-01

View all →

Related CVEs

Same severity, most recent

CVE-2026-97191
The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators onto their own posts.
2026-11-07 · score 2.7
CVE-2026-97190
The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own object on arbitrary posts, users, or terms they cannot otherwise edit.
2026-11-07 · score 2.7
CVE-2026-97189
The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.
2026-11-07 · score 2.7
CVE-2026-118529
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that a user owns a listing before processing a featured-listing checkout for it, allowing any authenticated user, such as a subscriber, to publish and feature another user's pending listing when the featured listing fee is set to zero.
2026-11-07 · score 3.1
CVE-2025-15708
The Live Composer WordPress plugin before 2.1.23 does not sanitise and escape some of its custom post type slug settings before using them in front-end links, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).
2026-11-07 · score 3.5