U.S. CISA adds TeleMessage TM SGNL flaws to its Known Exploited Vulnerabilities catalog
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-48927 +1 in the same advisory: …48928 | Unauthenticated Heap Dump Disclosure in Smarsh TeleMessage TM SGNL CVE-2025-48927 is an insecure-default-configuration flaw (CWE-1188) in the TeleMessage TM SGNL messaging-archiving service sold by Smarsh, in which Spring Boot Actuator was enabled with its heap dump endpoint exposed at the /heapdump URI in service builds through 2025-05-05. The endpoint required no authentication, so any unauthenticated remote attacker could simply request /heapdump and download the Java process's heap dump, with no privileges or user interaction required. A heap dump exposes the application's in-memory state, potentially including archived message content, credentials, and session secrets, so the impact is confidentiality (information disclosure). Affected parties are organizations and users of the TeleMessage TM SGNL service running service builds through 2025-05-05. The flaw was exploited in the wild in May 2025 and CISA added it to the Known Exploited Vulnerabilities catalog on 2025-07-01 (ransomware use unknown, no public proof-of-concept known), with EPSS currently at about 11% probability of exploitation over the next 30 days. Do: U.S. federal agencies must apply mitigations per Smarsh/TeleMessage instructions under BOD 22-01, or discontinue use of the service if mitigations are unavailable. Other customers should confirm with the vendor that their TM SGNL service is running builds later than 2025-05-05 with the Actuator /heapdump endpoint disabled or authenticated, review whether service credentials or archived message data may have leaked through heap dumps, and rotate any exposed secrets. | 5.3 group max | 11% | KEV |
| nicheunknown; plausibly thousands of users across a limited set of government and enterprise customers of the hosted TM SGNL service (no public user or install… |
Full article270 words · extracted from securityaffairs.com · click to collapse
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds TeleMessage TM SGNL flaws to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added TeleMessage TM SGNL flaws to its Known Exploited Vulnerabilities (KEV) catalog.
Below are the descriptions for these flaws:
- CVE-2025-48927 (CVSS score of 5.3) TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability
- CVE-2025-48928 (CVSS score of 4.0) TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability
CVE-2025-48927 is an Initialization of a Resource with an Insecure Default Vulnerability that affects TeleMessage TM SGNL. TeleMessage, up to May 5, 2025, had a misconfigured Spring Boot Actuator exposing a /heapdump endpoint, which was exploited in real-world attacks that same month.
CVE-2025-48928 is a Core Dump File to an Unauthorized Control Sphere Vulnerability affecting TeleMessage TM SGNL. The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a “core dump” in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerabilities by July 22, 2025.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/179542/hacking/u-s-cisa-adds-telemessage-tm-sgnl-flaws-to-its-known-exploited-vulnerabilities-catalog.html