CVE-2025-48928
TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability
Description
CVE-2025-48928 is a medium-severity information exposure vulnerability in TeleMessage TM SGNL, a messaging archival service marketed as a compliant alternative to Signal for government and enterprise use. The vulnerability arises because the TeleMessage service stores sensitive data, including previously transmitted passwords, in the Java heap memory. An attacker with local access can extract this data from heap dumps, exposing user credentials and potentially archived message content. Rated CVSS v3.1 4.0, the flaw requires local access but no authentication or user interaction. CISA added CVE-2025-48928 to the Known Exploited Vulnerabilities catalog with a remediation deadline of July 22, 2025, and its EPSS score of 5.11% at the 90th percentile reflects elevated exploitation probability for a local access vulnerability.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| smarsh | telemessage | - |
References
- https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/(Press/Media Coverage)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48928(US Government Resource)
Weakness Type
CWE-528: Exposure of Data from Heap Dump
The TeleMessage service's Java application retains sensitive data including user passwords in heap memory during normal operation. When a heap dump is generated (intentionally or through crash), this data becomes accessible in the dump file, exposing credentials and potentially message content to anyone who can access the heap dump.
Learn more: CWE-528 — Exposure of Data from Heap Dump
CWE-552: Files or Directories Accessible to External Parties
CVE-2025-48928 also involves sensitive heap dump files being accessible to parties who should not have access to them. The TeleMessage service does not adequately protect heap dump files from unauthorized access, allowing an attacker with local system access to read the dump and extract sensitive information.
Learn more: CWE-552 — Files or Directories Accessible to External Parties
Impact Analysis
CVE-2025-48928 poses a confidentiality risk through exposure of sensitive data stored in the Java heap. The attack requires local access (AV:L) but has low complexity (AC:L), needs no authentication (PR:N), and no user interaction (UI:N). Confidentiality impact is low (C:L) in the CVSS assessment, reflecting that the exposed data is limited to what resides in heap memory at the time of the dump. However, the real-world impact is significant given that TeleMessage was used by government officials and enterprise users for secure messaging archival — the heap may contain user passwords, authentication tokens, and fragments of archived messages sent over HTTP. The political sensitivity of TeleMessage's use case, including deployment by U.S. government personnel as reported by Wired, elevates the practical impact beyond the CVSS score. The EPSS score of 5.11% at the 90th percentile indicates above-average exploitation probability, particularly given the high-value targets using this service.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2025-48928 by adding it to the Known Exploited Vulnerabilities catalog. The vulnerability was exploited in the wild in May 2025, as documented by Wired, which reported that the TeleMessage service was compromised in approximately 20 minutes using this and related vulnerabilities. The EPSS score of 5.11% at the 90th percentile reflects elevated exploitation activity. While the attack requires local access to the server, the companion vulnerability CVE-2025-48927 (exposed Spring Boot Actuator heap dump endpoint) can provide remote access to heap dumps, effectively chaining with CVE-2025-48928 to enable remote credential extraction. Organizations using TeleMessage should treat both vulnerabilities as a combined remote information disclosure chain.
Remediation
-
Discontinue use of TeleMessage TM SGNL if running the affected version (through 2025-05-05). Evaluate alternative messaging archival solutions that implement proper credential handling and memory protection.
-
Restrict local access to TeleMessage servers and ensure heap dump files are stored with restrictive file permissions accessible only to authorized administrators. Implement monitoring for any heap dump file creation events.
-
Rotate all credentials that may have been processed by the TeleMessage service, including user passwords, API keys, and authentication tokens. Any credentials sent through the TeleMessage service should be considered potentially compromised.
-
Implement Java security hardening including disabling heap dump generation in production environments where not strictly needed, using the
-XX:-HeapDumpOnOutOfMemoryErrorflag, and ensuring sensitive data is cleared from memory after use through proper secure coding practices. -
Audit TeleMessage server access logs for any unauthorized access to heap dump files, abnormal process activity, or signs of data exfiltration. Given the confirmed exploitation in May 2025, conduct a thorough forensic review of any TeleMessage deployment.
Technical Details
CVE-2025-48928 is an information exposure vulnerability in the TeleMessage TM SGNL messaging archival service, with the CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicating local access requirements with low complexity and confidentiality-only impact. The TeleMessage service is implemented as a JSP-based Java web application that processes and archives messages. The core issue is that the Java heap retains sensitive data — including passwords previously transmitted over HTTP — in memory without proper clearing. In Java applications, the heap serves as the primary memory allocation area for objects, and its contents are essentially equivalent to a core dump, containing all application state including string objects holding credentials, session tokens, and message fragments. When a heap dump is generated through JVM diagnostic tools, crash events, or the exposed Spring Boot Actuator endpoint (see CVE-2025-48927), this sensitive data becomes available in a structured format that can be easily searched and extracted. The vulnerability is compounded by the fact that passwords were sent over HTTP rather than HTTPS, increasing the window during which credential data persists in heap memory.
Frequently Asked Questions
Is CVE-2025-48928 being actively exploited?
Yes. CVE-2025-48928 was actively exploited in May 2025, with the TeleMessage service reportedly compromised within 20 minutes. CISA has added it to the KEV catalog, confirming the threat to organizations still running the affected service.
What products are affected by CVE-2025-48928?
TeleMessage TM SGNL (marketed by Smarsh) through the version available on 2025-05-05 is affected. The service is a messaging archival platform used by government agencies and enterprises for compliance-focused message retention.
How do I fix CVE-2025-48928?
Discontinue use of the affected TeleMessage version and rotate all credentials that may have been processed by the service. Restrict local server access and disable unnecessary heap dump generation in Java environments.
How severe is CVE-2025-48928?
The CVSS score of 4.0 (Medium) reflects the local access requirement and limited confidentiality impact. However, when combined with CVE-2025-48927 (remote heap dump access), the practical severity is significantly higher, as the chain enables remote credential extraction from the messaging service.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.