CVE-2025-48927

UNKNOWNKnown Exploited

CISA Known Exploited Vulnerability

It is recommended that mitigations be applied per vendor instructions if available. If these instructions cannot be located or if mitigations are unavailable, discontinue use of the product. ; https://nvd.nist.gov/vuln/detail/CVE-2025-48927

Remediation deadline: July 22, 2025

Description

TeleMessage TM SGNL contains an initialization of a resource with an insecure default vulnerability. This vulnerability relies on how the Spring Boot Actuator is configured with an exposed heap dump endpoint at a /heapdump URI.

Timeline

Published:July 1st, 2025 12:00 AM

Last modified:July 1st, 2025 12:00 AM

Added to KEV:July 1st, 2025

CVSS Scoring

No CVSS v3 score available

Affected Software

From NVD CPE configuration data

Vendors

TeleMessage

Products

TM SGNL

Weaknesses (CWE)

CWE-1188

References & Reports

Advisories, patches, and third-party reports

No references available.

Source: CISA KEV + NVD · Data may lag official sources by up to one minute