CVE-2025-48927
mediumpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.111 · 96 %ileEURUUSadded 2025-07-01remediate by 2025-07-22
required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
EPSS · scored 2026-10-22
TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability
The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
ATT&CK techniques
ATT&CK techniques this enables or maps to.
affected products (3)
Products and version ranges known to be affected.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (6)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2025-48927cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2025-48927cnnvd
- https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/cnnvd
- https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/enisa_euvd
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48927US Government Resourcenvd
- https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/Press/Media Coveragenvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan