The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessage End-to-End encryption from the mobile phone through to the corporate archive documentation, as exploited in the wild in May 2025.
Weakness
The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product’s users or administrators.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Text_message_archiver | Telemessage | * | 2025-05-05 (including) |
Potential Mitigations
Related Attack Patterns
References
- https://arstechnica.com/security/2025/05/signal-clone-used-by-trump-official-stops-operations-after-report-it-was-hacked/
- https://news.ycombinator.com/item?id=43909220
- https://www.theregister.com/2025/05/05/telemessage_investigating/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47729