Hackers Exploit TeleMessage Vulnerability 11 IP Addresses Detected

Hackers are actively exploiting a critical vulnerability in the TeleMessage app, a messaging platform designed for enterprise use. The vulnerability, identified as CVE-2025-48927, arises from the exposure of the '/heapdump' endpoint from Spring Boot Actuator without proper authentication. This flaw allows unauthorized access to sensitive information, potentially leading to the leakage of passwords and other confidential data.

The TeleMessage app, which is similar to the Signal App but allows for the archiving of chats for compliance purposes, has been under scrutiny due to this security issue. The vulnerability was initially addressed by TeleMessage, but hackers continue to scan for systems that may still be vulnerable. This ongoing reconnaissance work highlights the persistent threat posed by unpatched vulnerabilities, even after initial fixes have been implemented.

According to a report from threat intelligence company, hackers have attempted to exploit the vulnerability since April, with 11 IP addresses detected. Additionally, 2,009 IPs have searched for Spring Boot Actuator endpoints in the past 90 days, and 1,582 IPs have specifically targeted the /health endpoints, which commonly detect Spring Boot Actuator deployments. The flaw allows hackers to extract data from vulnerable systems, stemming from the platform’s continued use of a legacy confirmation in Spring Boot Actuator.

The implications of this vulnerability are significant. Enterprises relying on TeleMessage for secure communication could face severe consequences if their systems are compromised. The exposure of sensitive information could lead to data breaches, financial losses, and reputational damage. Organizations are advised to ensure that their systems are fully patched and to implement robust security measures to protect against such threats.

In response to the ongoing reconnaissance efforts, security experts recommend several best practices. Organizations should apply the principle of least privilege to all systems and services, ensuring that only authorized users have access to critical data. Regular updates to antivirus signatures, operating systems, and third-party applications are essential to mitigate the risk of exploitation. Additionally, the use of behavioral detection solutions can help identify and respond to malware payloads more effectively.

Users are also encouraged to adopt strong security practices. This includes using unique and strong passwords for each site, with the assistance of a password manager, and enabling multi-factor authentication whenever possible. Being vigilant against social engineering and phishing attacks is crucial, as these tactics are often used to gain unauthorized access to systems.

The TeleMessage vulnerability serves as a reminder of the importance of proactive security measures. Organizations must remain vigilant and responsive to emerging threats, ensuring that their systems are protected against both known and unknown vulnerabilities. By implementing comprehensive security strategies, enterprises can safeguard their data and maintain the trust of their users.