CVE-2025-48925

Description

The TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to do MD5 hashing, and then accepts the hash as the authentication credential, as exploited in the wild in May 2025.

Reserved 2025-05-28 | Published 2025-05-28 | Updated 2025-05-28 | Assigner mitre

Problem types

CWE-836 Use of Password Hash Instead of Password for Authentication

Product status

Default status
unknown

Any version
affected

References

www.wired.com/...f-app-telemessage-got-hacked-in-20-minutes/

cve.org (CVE-2025-48925)

nvd.nist.gov (CVE-2025-48925)

Download JSON