CVSS 3.1
4.0 mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NCVE-2025-48928
Medium (4.0) in TeleMessage TM SGNL. In CISA KEV since 2025-07-01. EPSS 0.6% chance of exploitation in the next 30 days.
The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2025-07-01, due 2025-07-22
- CWEs
- CWE-552, CWE-528
- Published
- Modified
- Record from
- the NVD, synced
Affected
- smarsh:telemessage