CVE-2025-48927: Tele Message TM SGNL Initialization of a Resource with an Insecure Default Vulnerability
Summary: CVE-2025-48927 affects TeleMessage TM SGNL through an initialization of a resource with an insecure default vulnerability, tied to how Spring Boot Actuator is configured with an exposed heap dump endpoint at a /heapdump URI. CISA lists a remediation due date of 2025-07-22, and known ransomware campaign use is unknown.
Key Takeaway: An exposed /heapdump endpoint hands over whatever sits in application memory, and CISA's 2025-07-22 due date puts TM SGNL on a federal remediation clock while ransomware use of this CVE remains unconfirmed.
Read the original at CISA KEV Catalog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-48927TeleMessage
- Related
- CVE-2025-48928: Tele Message TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability Known Exploited Vulnerabilities · Jul 01, 2025CVE-2025-47729: Tele Message TM SGNL Hidden Functionality Vulnerability Known Exploited Vulnerabilities · May 12, 2025At The Edge Clear: June 15 - 23, 2026 Cyber Risks ·