CVE-2025-48927
TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability
Description
CVE-2025-48927 is a medium-severity information disclosure vulnerability in TeleMessage TM SGNL, a messaging archival service used by government agencies and enterprises. The vulnerability exists because the TeleMessage service configures Spring Boot Actuator with an exposed heap dump endpoint at a publicly accessible /heapdump URI, allowing an unauthenticated remote attacker to download the complete Java heap contents, which may include user credentials, authentication tokens, and archived message data. Rated CVSS v3.1 5.3, this insecure default configuration was actively exploited in the wild in May 2025 and has been added to CISA's Known Exploited Vulnerabilities catalog with a deadline of July 22, 2025. The EPSS score of 4.68% at the 89th percentile reflects elevated exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| smarsh | telemessage | - |
References
- https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/(Press/Media Coverage)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48927(US Government Resource)
Weakness Type
CWE-1188: Insecure Default Initialization of Resource
CVE-2025-48927 is classified under CWE-1188, Initialization of a Resource with an Insecure Default. The TeleMessage service deploys Spring Boot Actuator with its heap dump endpoint enabled and publicly accessible by default, without authentication or access restrictions. This insecure default configuration exposes sensitive diagnostic data to any network-accessible attacker, violating the principle of secure-by-default design.
Learn more: CWE-1188 — Insecure Default Initialization of Resource
Impact Analysis
CVE-2025-48927 enables remote, unauthenticated access to the complete Java heap contents of the TeleMessage service. The attack is network-accessible (AV:N) with low complexity (AC:L), requiring no authentication (PR:N) and no user interaction (UI:N). Confidentiality impact is low (C:L) per the CVSS assessment, though the practical impact depends heavily on what data resides in the heap at the time of the dump. In the case of TeleMessage, the heap dump can contain user credentials transmitted over HTTP, session tokens, configuration secrets, and fragments of archived messages. When combined with CVE-2025-48928, which documents the presence of sensitive credentials in heap memory, this vulnerability provides a complete remote attack chain for credential extraction. The TeleMessage service was notably used by U.S. government officials, as reported by Wired, making the data exposure particularly sensitive. The EPSS score of 4.68% at the 89th percentile confirms above-average exploitation activity.
Exploit Maturity
CVE-2025-48927 was actively exploited in the wild in May 2025, as documented by Wired, which reported that the TeleMessage service was compromised using this exposed endpoint within approximately 20 minutes. CISA has confirmed active exploitation by adding CVE-2025-48927 to the KEV catalog. The EPSS score of 4.68% at the 89th percentile indicates elevated exploitation probability. Exploitation is trivial — an attacker simply needs to send an HTTP GET request to the /heapdump endpoint on the TeleMessage server to download the complete Java heap contents. No specialized exploit code is needed; standard HTTP tools like curl or a web browser are sufficient. The simplicity of exploitation and the high-value data contained in the heap dump make this vulnerability an attractive target for intelligence-gathering operations and credential theft campaigns.
Remediation
-
Disable or restrict the Spring Boot Actuator heap dump endpoint immediately. Remove the /heapdump endpoint from publicly accessible URLs by configuring
management.endpoints.web.exposure.exclude=heapdumpor by disabling actuator endpoints entirely withmanagement.endpoints.enabled-by-default=false. -
Implement authentication on all Actuator endpoints using Spring Security. Configure Actuator to require authentication with strong credentials, and restrict access to management endpoints to trusted IP ranges using network-level controls.
-
Rotate all credentials that may have been exposed through heap dumps, including user passwords, API keys, database connection strings, and authentication tokens processed by the TeleMessage service.
-
Review web server access logs for requests to the /heapdump, /actuator/heapdump, and other Spring Boot Actuator endpoints. Any successful requests to these endpoints from unauthorized sources indicate data compromise.
-
Conduct a comprehensive review of Spring Boot Actuator configuration across all production deployments. Ensure that sensitive endpoints (heapdump, env, configprops, trace) are disabled or restricted by default, and implement automated security scanning to detect exposed Actuator endpoints.
Technical Details
CVE-2025-48927 is an insecure default configuration vulnerability in the TeleMessage TM SGNL service, with the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicating remote, unauthenticated access with confidentiality impact. The TeleMessage service is built on the Spring Boot framework and includes Spring Boot Actuator, a module that provides operational endpoints for monitoring and diagnostics. The /heapdump endpoint, when enabled, generates and serves a complete HPROF-format dump of the Java Virtual Machine heap. The vulnerability is that TeleMessage deploys this endpoint in a publicly accessible configuration without authentication or access restrictions. An attacker can issue a simple HTTP GET request to the /heapdump URI path and receive the entire contents of the application's heap memory in a downloadable file. The heap dump can be analyzed using standard Java diagnostic tools (jhat, Eclipse MAT, VisualVM) to extract string objects, which typically contain credentials, session tokens, configuration values, and application data. The vulnerability was exploited in the wild in May 2025, demonstrating that the TeleMessage production deployment had the Actuator heapdump endpoint exposed to the internet.
Frequently Asked Questions
Is CVE-2025-48927 being actively exploited?
Yes. CVE-2025-48927 was actively exploited in May 2025 to compromise the TeleMessage service. CISA has confirmed active exploitation by adding it to the KEV catalog. The attack is trivial to execute, requiring only a single HTTP request to download the heap dump.
What products are affected by CVE-2025-48927?
TeleMessage TM SGNL (marketed by Smarsh) through the version available on 2025-05-05 is affected. Any deployment with the Spring Boot Actuator heap dump endpoint exposed is vulnerable.
How do I fix CVE-2025-48927?
Disable the Spring Boot Actuator heap dump endpoint or restrict it with authentication and network-level access controls. Rotate all credentials that may have been processed by the TeleMessage service and review access logs for unauthorized heapdump requests.
How severe is CVE-2025-48927?
The CVSS score of 5.3 (Medium) reflects the limited data per individual heap dump. However, the practical severity is elevated by the trivial exploitation method, the sensitive data stored by messaging archival services, and the confirmed use by government agencies. When combined with CVE-2025-48928, the vulnerability chain enables complete remote credential extraction.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.