CVE-2025-48925

Katalog CVE

CVSS 7.5 · High EPSS 0,26%

Kerentanan Use of Password Hash Instead of Password for Authentication pada smarsh telemessage. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to do MD5 hashing, and then accepts the hash as the authentication credential.

Rincian

Terbit di NVD

28 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-836: Use of Password Hash Instead of Password for Authentication

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 16,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/ press/media coverage