VulnerabilityAnalyzed

CVE-2025-48927

TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability

KEVMEDIUM 5.3EPSS 11.1%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 22 July 2025). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: 11.10% probability · 96th percentile
CISA KEV: Listed 1 July 2025 · due 22 July 2025
Weakness: CWE-1188
Affected: smarsh/telemessage
Source: cve@mitre.org

CISA notes

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. It is recommended that mitigations be applied per vendor instructions if available. If these instructions cannot be located or if mitigations are unavailable, discontinue use of the product. ; https://nvd.nist.gov/vuln/detail/CVE-2025-48927

References

https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/Press/Media Coverage
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48927US Government Resource

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.