Actively exploited in the wild
TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability
TeleMessage - TM SGNL · Listed in the CISA KEV since 2025-07-01. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-48927
MediumCVSS 5.3KEVSummary
The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.
Risk Assessment
A publicly accessible heap dump can expose sensitive data, including credentials and session information, enabling attackers to further penetrate the system.
Recommendation
Disable or secure the /heapdump endpoint in Spring Boot Actuator and update the TeleMessage service to a version without this vulnerability.
Other vulnerabilities in TeleMessage
See all- CVE-2025-48928MediumActively exploited
The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.
- CVE-2025-47729LowActively exploited
The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (Archive Signal) app users, contrary to the documented end-to-end encryption. This was exploited in the wild in May 2025.
Original NVD description (English source)
The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.