telemessage vulnerabilities and fixes

Recent CVEs affecting telemessage, with upgrade or downgrade steps. 8 tracked.

telemessage has 8 tracked vulnerabilities, 0 critical and 2 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 7. Most recent: 2025-05-28. Highest priority: CVE-2025-48927 (score 73/100).

• CVE-2025-48931 LOW 3.2 UPGRADE The TeleMessage service through 2025-05-05 relies on MD5 for password hashing, which opens up various attack p
• CVE-2025-48930 LOW 2.8 UPGRADE The TeleMessage service through 2025-05-05 stores certain cleartext information in memory, even though memory
• CVE-2025-48929 MEDIUM 4.0 UPGRADE The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., no
• CVE-2025-48928 MEDIUM 4.0 EXPLOITED MITIGATE TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability
• CVE-2025-48927 MEDIUM 5.3 EXPLOITED MITIGATE TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability
• CVE-2025-48926 MEDIUM 4.3 UPGRADE The admin panel in the TeleMessage service through 2025-05-05 allows attackers to discover usernames, e-mail a
• CVE-2025-48925 MEDIUM 4.3 UPGRADE The TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to do MD5 hashing
• CVE-2025-47730 MEDIUM 4.8 UPGRADE The TeleMessage archiving backend through 2025-05-05 accepts API calls (to request an authentication token) fr

FAQ

How do I fix telemessage vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is telemessage being exploited right now?

Yes: 2 telemessage CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which telemessage CVE should I patch first?

CVE-2025-48927 currently ranks highest (73/100): TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability.

RSS feed for telemessage · ← Back to latest CVEs