CVE-2025-48928
KEVTeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability
Description
TeleMessage TM SGNL contains an exposure of core dump file to an unauthorized control sphere Vulnerability. This vulnerability is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump.
The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.
CVSS 3.1 vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NPublishedMay 28, 2025
Last modifiedJun 17, 2026
Added to KEVJul 1, 2025
Remediation dueJul 22, 2025
References
- wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/Press/Media Coverage
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48928US Government Resource
0 recent articles mention this CVE
50
Risk assessment · Medium
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 461 days
- CVSS
- 4.0 MEDIUM
- EPSS (30-day exploit probability)
- 0.58% · top 53% of all CVEs
- Weakness
- CWE-528
- Preconditions
- No privileges and no user interaction
Recommended actions
- 1.Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.