Vulnerabilities

The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token with a short expiration time) that can be reused at a later date if discovered by an adversary.

CVE-2025-48927 is an insecure-default-configuration flaw (CWE-1188) in the TeleMessage TM SGNL messaging-archiving service sold by Smarsh, in which Spring Boot Actuator was enabled with its heap dump endpoint exposed at the /heapdump URI in service builds through 2025-05-05. The endpoint required no authentication, so any unauthenticated remote attacker could simply request /heapdump and download the Java process's heap dump, with no privileges or user interaction required. A heap dump exposes the application's in-memory state, potentially including archived message content, credentials, and session secrets, so the impact is confidentiality (information disclosure). Affected parties are organizations and users of the TeleMessage TM SGNL service running service builds through 2025-05-05. The flaw was exploited in the wild in May 2025 and CISA added it to the Known Exploited Vulnerabilities catalog on 2025-07-01 (ransomware use unknown, no public proof-of-concept known), with EPSS currently at about 11% probability of exploitation over the next 30 days.

Do: U.S. federal agencies must apply mitigations per Smarsh/TeleMessage instructions under BOD 22-01, or discontinue use of the service if mitigations are unavailable. Other customers should confirm with the vendor that their TM SGNL service is running builds later than 2025-05-05 with the Actuator /heapdump endpoint disabled or authenticated, review whether service credentials or archived message data may have leaked through heap dumps, and rotate any exposed secrets.

The TeleMessage archiving backend through 2025-05-05 accepts API calls (to request an authentication token) from the TM SGNL (aka Archive Signal) app with the credentials of logfile for the user and enRR8UVVywXYbFkqU#QDPRkO for the password.