CVE-2025-48927

TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability

TeleMessage TM SGNL

CVSS

5.3Medium

ExploitationExploited in the wildAdded to KEV 1 Jul 2025CISA KEV

Exploit odds (EPSS)11.1%Chance of exploitation activity in the next 30 days, higher than 95% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed inNone listedNo source names a fixed version yet

Federal deadline22 Jul 2025Remediation due date for US federal agenciesCISA KEV

CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

No source in this snapshot names a fixed version.

Timeline

28 May 2025, 00:00 UTCPublishedCVE List
1 Jul 2025Added to CISA KEVCISA KEV

Description

TeleMessage TM SGNL contains an initialization of a resource with an insecure default vulnerability. This vulnerability relies on how the Spring Boot Actuator is configured with an exposed heap dump endpoint at a /heapdump URI.

Text from CVE List

Affected versions 1

serviceaffected: all versions through 2025-05-05CVE List