CVE-2025-48927: TeleMessage SGNL Heapdump Leak Vulnerability Remediated, No Exploitation Detected

What Happened

A flaw in TeleMessageTM SGNL’s Spring Boot Actuator exposed a publicly accessible /heapdump endpoint. The endpoint could return a full 150 MB snapshot of heap memory, potentially containing plaintext usernames, passwords, and other sensitive data.

Impact

Attackers could have harvested credentials and other confidential information from the heap dump. The vulnerability was listed in CISA’s Known Exploited Vulnerabilities catalog on July 14.

Remediation

TeleMessage remediated CVE-2025-48927 in early May 2025. The fix was applied centrally across the cloud‑native SaaS platform, and independent verification confirmed the patch. No action is required from customers, and all exploitation attempts since the fix have been unsuccessful.

"CVE-2025-48927 was fully remediated in the TeleMessage environment in early May. That remediation has been independently verified by our third‑party cybersecurity partner. As a cloud‑native SaaS platform, all fixes were applied centrally, and no action was required by customers."

What to Do

• Verify that your TeleMessage SGNL deployment is on a version released after the early‑May patch.
• Confirm that the Spring Boot Actuator /heapdump endpoint is disabled or protected by authentication.
• Use GreyNoise feeds to monitor for reconnaissance or exploitation attempts targeting TeleMessage or similar services.
• Maintain regular vulnerability scanning and patch management for all messaging platforms.