Login Request a demo
Low severity · published Oct 14, 2020
CVE-2020-25824
Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export Telegram Data wizard
2.4
CVSS
0.5%
EPSS
No
On KEV
Description
Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export Telegram Data wizard. The threat model is a victim who has voluntarily opened Export Wizard but is then distracted. An attacker then approaches the unattended desktop and pushes the Export key. This attacker may consequently gain access to all chat conversation and media files.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TD
Telegram Desktop · Telegram
through 2.4.3 · source: NVD
Affected product
TD
Telegram Desktop
Telegram
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-25824
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-25824
Third Party Advisory
https://github.com/soheilsamanabadi/vulnerability/blob/main/Telegram-Desktop-CVE-2020-25824
Release Notes
https://github.com/telegramdesktop/tdesktop/releases/tag/v2.4.3
Third Party Advisory
https://security.gentoo.org/glsa/202101-34
Product
https://www.Telegram.org
More from Telegram Desktop
9.8
CVE-2018-17613
Telegram Desktop (aka tdesktop) 1.3.16 alpha, when "Use proxy" is enabled, sends credentials and application data in cleartext over the SOCKS5 protocol
8.8
CVE-2019-10044
Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph attack when displaying messages containing…
8.2
CVE-2026-94488
Telegram Desktop before 6.9.4 allows XSS in the HTML exporter
8.1
CVE-2026-107181
Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme
7.8
CVE-2020-17448
Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protection mechanism, as demonstrated by use of the chat window with a…