Horizon Alert
Summary of the vulnerability and why it matters
The TeleMessage archiving backend stores message data in plain text, contrary to its documented end-to-end encryption. This flaw was exploited in May 2025.
- Vulnerable TeleMessage archiving backend
- Stores sensitive messages in cleartext
- Potential for unauthorized data access
Attack Path
How an attacker could exploit the issue
The TeleMessage archiving backend retains cleartext message copies, deviating from its documented end-to-end encryption. This allows attackers to potentially access sensitive communications. The compromise occurred in the wild during May 2025.
- Exposure condition: Network access required.
- Attacker starting point: Authenticated user.
- Trigger and result: Access cleartext message copies.
Live Threat
Current exploitation, exposure, and threat context
The TeleMessage archiving backend has a vulnerability where it stores cleartext messages from TM SGNL app users. This contradicts the documented end-to-end encryption. The vulnerability was exploited in the wild in May 2025.
- Likely attacker skill level: High.
- Required access or conditions: Authenticated access.
- Business risk or urgency: High.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
The TeleMessage archiving backend stores cleartext message copies, diverging from documented encryption promises and leading to exploitation. This affects organizations using the TM SGNL app, potentially exposing user messages. The vendor has acknowledged this issue, and it is listed in the CISA Known Exploited Vulnerabilities catalog.
- Identify TeleMessage archiver instances.
- Restrict access to the archiving system.
- Implement vendor-provided fixes and validate.
- Monitor for related security events.
