CVE-2025-48928: TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability

What it is

The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.

Exploitation evidence

First exploit evidence seen: 2025-07-01 (earliest date across the sources below).

Exploited in the wild

• CISA KEV: listed since 2025-07-01. Source

Sources: CISA KEV.

How to fix it

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (source: CISA KEV)

Fixed versions

NVD does not list a fixed version for this CVE. Use the vendor advisory below.

Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.

Vendor advisories and patches

MITRE ATT&CK mitigations for this chain

• M1050 Exploit Protection (for T1212) : Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. Control flow integrity checking is another way to potentially identify and stop a software exploit
• M1051 Update Software (for T1212, T1555) : Update software regularly by employing patch management for internal enterprise endpoints and servers.
• M1013 Application Developer Guidance (for T1212) : Application developers should consider taking measures to validate authentication requests by enabling one-time passwords, providing timestamps or sequence numbers for messages sent, using digital signatures, and/or using random session keys.
• M1019 Threat Intelligence Program (for T1212) : Develop a robust cyber threat intelligence capability to determine what types and levels of threat may use software exploits and 0-days against a particular organization.
• M1048 Application Isolation and Sandboxing (for T1212) : Make it difficult for adversaries to advance their operation through exploitation of undiscovered or unpatched vulnerabilities by using sandboxing. Other types of virtualization and application microsegmentation may also mitigate the impact of some types of exploitation. Risks of additional exploits and weaknesses in t
• M1026 Privileged Account Management (for T1555) : Limit the number of accounts and services with permission to query information from password stores to only those required. Ensure that accounts and services with permissions to query password stores only have access to the secrets they require.
• M1027 Password Policies (for T1555) : The password for the user's login keychain can be changed from the user's login password. This increases the complexity for an adversary because they need to know an additional password. Organizations may consider weighing the risk of storing credentials in password stores and web browsers. If system, software, or web
• M1057 Data Loss Prevention (for T1005) : Data loss prevention can restrict access to sensitive data and detect sensitive data that is unencrypted.

Detection Generic guidance

• Credential Access: Monitor for credential dumping, unusual LSASS access and sudden authentication from new sources.
• Collection: Watch for bulk reads of databases, file shares or mailboxes by the affected service.

Response checklist Generic guidance

1. Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
2. Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
3. Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
4. Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.