CVE-2025-48928
Smarsh Telemessage
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2025-48928 is a medium-severity Exposure of Core Dump File to an Unauthorized Control Sphere (CWE-528) vulnerability in Smarsh Telemessage. Its CVSS base score is 4.0 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 34th percentile by exploit likelihood (below the median); CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The vulnerability affects the TeleMessage service through 2025-05-05, which relies on a JSP application. In this implementation the application heap retains content comparable to a core dump, exposing passwords that were previously transmitted over HTTP. The issue is tracked as CVE-2025-48928 with CVSS 4.0 and is associated with CWE-528 and CWE-552.
An attacker with local access to the affected system can read the retained heap data without authentication or user interaction. This allows recovery of credentials sent in earlier HTTP requests, resulting in disclosure of sensitive authentication material.
The vulnerability was exploited in the wild in May 2025 and is listed in the CISA Known Exploited Vulnerabilities catalog. Public reporting describes TeleMessage as a Signal knock-off application whose heap exposure enabled rapid compromise of stored passwords.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-16214
Vulnerability Data
The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in…
more
the wild in May 2025.
- CWE(s)
- KEV Date Added
- 01 July 2025
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 8 hardening rules · 3 OS baselines
V8.4.2
Mitigating Controls (NIST 800-53 r5) AI
Enforces access authorizations on the core-dump file so that only authorized actors can read it.
Limits which processes and users are granted rights to the directory or file containing the core dump.
AC-4 enforces information flow rules that can block unauthorized external access to files or directories.
Requires confidentiality protection of information at rest, directly covering the exposed core-dump contents.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing and reviewing access permissions directly prevents unauthorized access to core-dump files.
Protecting confidentiality of data-at-rest covers sensitive memory contents stored in core dumps.
Logical segmentation and access protections stop external parties from reaching files that should remain internal.
Secure configuration baselines can restrict core-dump locations and permissions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
By tracing and retrieving all copies of information stored on endpoint and portable devices, the control reduces the likelihood that files remain accessible outside the organization’s security perimeter.
Classification helps identify core dumps as sensitive, but does not enforce storage or access restrictions.
Access-control policies can restrict who may read core-dump files, yet the control is broader than this specific weakness.
Granting only the minimum rights needed can prevent unauthorized access to core dumps, but does not address how or where they are generated.
Including asset location and ownership in the inventory, combined with secure disposal procedures, decreases the chance that files or directories remain accessible to external parties after they should have been removed or restricted.
Solid perimeters and locked external access points stop files, devices, or directories containing sensitive data from being reachable by external parties who could otherwise walk in or break in.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (3 rules)
- V-248551 A sticky bit must be set on all OL 8 public directories to prevent unauthorized and unintended information transferred via shared system resources. prevents CWE-528
- V-248579 OL 8 must restrict access to the kernel message buffer. prevents CWE-552
- V-248597 There must be no "shosts.equiv" files on the OL 8 operating system. prevents CWE-552