CVE-2025-48925
CVE-2025-48925 is a medium-severity vulnerability in Smarsh Telemessage with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-836.
Key facts
- Severity: Medium (CVSS 3.x base score 4.3)
- EPSS exploit prediction: 0% (14th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-16211
- Weakness: CWE-836
- Affected product: Smarsh Telemessage
- Published:
- Last modified:
Description
The TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to do MD5 hashing, and then accepts the hash as the authentication credential.
Frequently asked questions
- What is CVE-2025-48925?
- The TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to do MD5 hashing, and then accepts the hash as the authentication credential.
- How severe is CVE-2025-48925?
- CVE-2025-48925 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
- Is CVE-2025-48925 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (14th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2025-48925?
- CVE-2025-48925 affects Smarsh Telemessage. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2025-48925?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2025-48925 have an EU (EUVD) identifier?
- Yes. CVE-2025-48925 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-16211.
- When was CVE-2025-48925 published?
- CVE-2025-48925 was published on 2025-05-28 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:smarsh:telemessage:*:*:*:*:*:*:*:*
More vulnerabilities in Smarsh Telemessage
- CVE-2025-48927 — Medium (CVSS 5.3): The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a…
- CVE-2025-47730 — Medium (CVSS 4.8): The TeleMessage archiving backend through 2025-05-05 accepts API calls (to request an authentication token) from the TM…
- CVE-2025-48926 — Medium (CVSS 4.3): The admin panel in the TeleMessage service through 2025-05-05 allows attackers to discover usernames, e-mail addresses,…
- CVE-2025-48929 — Medium (CVSS 4.0): The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token…
- CVE-2025-48928 — Medium (CVSS 4.0): The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly…
- CVE-2025-48931 — Low (CVSS 3.2): The TeleMessage service through 2025-05-05 relies on MD5 for password hashing, which opens up various attack…
All CVEs affecting Smarsh Telemessage →
Other CWE-836 vulnerabilities
- CVE-2023-34132 — Critical (CVSS 9.8): Use of password hash instead of password for authentication vulnerability in SonicWall GMS and Analytics allows…
- CVE-2023-4299 — Critical (CVSS 9.0): Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access…
- CVE-2023-39546 — High (CVSS 8.8): CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier,…
- CVE-2026-9222 — High (CVSS 8.1): Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only require the password hash when…
- CVE-2019-25552 — High (CVSS 7.5): CEWE PHOTO SHOW 6.4.3 contains a denial of service vulnerability that allows attackers to crash the application by…
- CVE-2025-52543 — High (CVSS 7.5): E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for…