TeleMessage vulnerabilities
Published CVEs affecting TeleMessage products: 3 record(s), with severity, exploitation and fixes.
CVE-2025-48928
Medium · 4.0
KEV High · 45 CWE-552 May 28, 2025
TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability
The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.
CVE-2025-48927
Medium · 5.3
KEV High · 55 CWE-1188 May 28, 2025
TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability
The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.
CVE-2025-47729
Medium · 4.9
KEV CWE-912 May 8, 2025
TeleMessage TM SGNL Hidden Functionality Vulnerability
The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessage "End-to-End encryption from the mobile phone through to the corporate archive" documentation, as exploited in the wild in May 2025.