Vulnerabilities

CVE-2025-48927 is an insecure-default-configuration flaw (CWE-1188) in the TeleMessage TM SGNL messaging-archiving service sold by Smarsh, in which Spring Boot Actuator was enabled with its heap dump endpoint exposed at the /heapdump URI in service builds through 2025-05-05. The endpoint required no authentication, so any unauthenticated remote attacker could simply request /heapdump and download the Java process's heap dump, with no privileges or user interaction required. A heap dump exposes the application's in-memory state, potentially including archived message content, credentials, and session secrets, so the impact is confidentiality (information disclosure). Affected parties are organizations and users of the TeleMessage TM SGNL service running service builds through 2025-05-05. The flaw was exploited in the wild in May 2025 and CISA added it to the Known Exploited Vulnerabilities catalog on 2025-07-01 (ransomware use unknown, no public proof-of-concept known), with EPSS currently at about 11% probability of exploitation over the next 30 days.

Do: U.S. federal agencies must apply mitigations per Smarsh/TeleMessage instructions under BOD 22-01, or discontinue use of the service if mitigations are unavailable. Other customers should confirm with the vendor that their TM SGNL service is running builds later than 2025-05-05 with the Actuator /heapdump endpoint disabled or authenticated, review whether service credentials or archived message data may have leaked through heap dumps, and rotate any exposed secrets.

TeleMessage's archiving backend (through 2025-05-05) silently retains cleartext copies of messages sent by users of the TM SGNL (Archive Signal) app, despite TeleMessage documentation advertising end-to-end encryption from the mobile phone through to the corporate archive. This stems from hidden backend functionality (CWE-912) rather than a remotely triggerable code flaw, and it was exploited in the wild in May 2025. Anyone who can reach those backend message stores, such as an attacker who compromises TeleMessage's infrastructure or the customer-facing archive, gains access to plaintext copies of users' messages, a high confidentiality impact reflected in the CVSS 4.9 score (high privileges required, no integrity or availability impact). Organizations and personnel who used TM SGNL through 2025-05-05 for compliance archiving are affected, including regulated enterprises and government users of the service. CISA added the issue to its Known Exploited Vulnerabilities catalog on 2025-05-12 with no public proof-of-concept known, and EPSS estimates a 0.4% chance of exploitation in the next 30 days.

Do: Apply mitigations per TeleMessage vendor instructions and follow applicable CISA BOD 22-01 guidance for cloud services, discontinuing use of TM SGNL if mitigations are unavailable. Treat messages archived through 2025-05-05 as potentially stored in cleartext and review backend/archive access controls and logs for signs of unauthorized access. Federal agencies must remediate per the KEV catalog deadline (added 2025-05-12).