CVE-2025-48927: TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability
TeleMessage TM SGNL contains an initialization of a resource with an insecure default vulnerability. This vulnerability relies on how the Spring Boot Actuator is configured with an exposed heap dump endpoint at a /heapdump URI.
Other sources
The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable or remove the exposed heap dump endpoint at /heapdump in the Spring Boot Actuator configuration so heap dumps are not publicly accessible.
Pivotal Spring Boot Actuator /heapdump endpoint exposure = disabled - Compensating control
Restrict access to the /heapdump endpoint (and other actuator management endpoints) to trusted IPs or internal networks using network controls (firewall, WAF, or ACLs); follow BOD 22-01 guidance for cloud services.
- Compensating control
Discontinue use of the TeleMessage product if suitable mitigations are unavailable.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48927?
CVE-2025-48927 is considered a critical vulnerability due to exposed sensitive data through the heap dump endpoint.
How do I fix CVE-2025-48927?
To fix CVE-2025-48927, ensure that the Spring Boot Actuator's heap dump endpoint is disabled or properly secured.
What systems are affected by CVE-2025-48927?
CVE-2025-48927 affects the TeleMessage service versions up to and including 2025-05-05 that use Spring Boot Actuator.
What are the potential impacts of exploiting CVE-2025-48927?
Exploitation of CVE-2025-48927 can lead to unauthorized access to sensitive application data including the memory state of the application.
When was CVE-2025-48927 first exploited?
CVE-2025-48927 was first exploited in the wild in May 2025.