CVE-2025-48928: TeleMessage TM SGNL JSP heap dump exposes passwords sent over HTTP

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is confirmed exploited in the wild and listed in CISA KEV, but the CVSS score is only 4.0 (medium) with local access and limited confidentiality impact.

What it is

The TeleMessage service through 2025-05-05 runs a JSP application whose heap content is roughly equivalent to a core dump, and a password previously sent over HTTP is included in that dump. This matters because credentials can be recovered from the exposed memory content, and the flaw was exploited in the wild in May 2025.

Impact

An attacker who can reach the exposed heap or core dump content gains a previously transmitted password, enabling credential theft and possible follow-on access to the affected service.

Attack surface

The CVSS vector is local (AV:L) with no privileges and no user interaction required, so the flaw is reached through local access to the heap or dump content rather than over the network. The description notes the password was previously sent over HTTP, but the record does not specify the exact retrieval path.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2025-07-01, confirming exploitation in the wild, while EPSS is low at 0.00553 (44.8th percentile).

What to do

• Apply vendor mitigations per Smarsh/TeleMessage instructions or discontinue use of the product if mitigations are unavailable, as directed by CISA KEV.
• Stop transmitting passwords over HTTP and enforce HTTPS for all credential submission.
• Restrict local access to the TeleMessage host and any heap or core dump files to authorized administrators only.
• Rotate any passwords that may have been sent over HTTP to the affected service.
• Follow BOD 22-01 guidance for cloud services where applicable.

Detection

• Search for and monitor access to heap or core dump files associated with the TeleMessage JSP application.
• Review HTTP traffic logs for password submissions to TeleMessage endpoints and flag any cleartext credential transmission.
• Hunt for unexpected local access or file reads on the TeleMessage host around the May 2025 exploitation window.
• Alert on authentication attempts using credentials that were previously transmitted over HTTP to the service.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.