Flaw in Signal App Clone Could Leak Passwords — Grey Noise Identifies Active Reconnaissance and Exploit Attempts

Summary: CVE-2025-48927 affects certain deployments of TeleMessage TM SGNL, an enterprise messaging system modeled after Signal, because the platform kept a legacy Spring Boot Actuator configuration that leaves the /heapdump endpoint publicly accessible without authentication, potentially returning a roughly 150MB heap snapshot with plaintext usernames and passwords. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on July 14, and as of July 16 GreyNoise had observed 11 IPs attempting to exploit it, with ongoing scanning for Spring Boot Actuator endpoints.
Why it matters: TeleMessage says it remediated the flaw centrally in early May and that later exploit attempts have been unsuccessful, but the endpoint's exposure through at least May 5 means credentials may already have been captured in heap dumps by anyone who reached it. Eleven IPs are now probing for this exact endpoint, so an unauthenticated diagnostic path in your own Spring Boot tools is the thing to check.

Read the original at GreyNoise Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-48927
Related: CVE-2025-48927: Tele Message TM SGNL Initialization of a Resource with an Insecure Default Vulnerability Known Exploited Vulnerabilities · Jul 01, 2025
At The Edge Clear: June 15 - 23, 2026 Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026