Actively exploited in the wild
TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability
TeleMessage - TM SGNL · Listed in the CISA KEV since 2025-07-01. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-48928
MediumCVSS 4.0KEVSummary
The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.
Risk Assessment
Exposure of passwords sent over HTTP can allow attackers to take over accounts and gain further access to organizational systems.
Recommendation
Update or decommission the TeleMessage service, enforce HTTPS-only transmission, and immediately rotate all passwords that may have been exposed.
Other vulnerabilities in TeleMessage
See all- CVE-2025-48927MediumActively exploited
The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.
- CVE-2025-47729LowActively exploited
The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (Archive Signal) app users, contrary to the documented end-to-end encryption. This was exploited in the wild in May 2025.
Original NVD description (English source)
The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.