Coverage › CVE-2025-48927

CVE-2025-48927 Mapped Sigma

TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability

Vendor / product

TeleMessage — TM SGNL

Description (CISA)

TeleMessage TM SGNL contains an initialization of a resource with an insecure default vulnerability. This vulnerability relies on how the Spring Boot Actuator is configured with an exposed heap dump endpoint at a /heapdump URI.

Added to KEV

2025-07-01

Due date

2025-07-22

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known ransomware use

Unknown

CWE

CWE-1188

CISA notes

It is recommended that mitigations be applied per vendor instructions if available. If these instructions cannot be located or if mitigations are unavailable, discontinue use of the product.
https://nvd.nist.gov/vuln/detail/CVE-2025-48927

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1005 Data from Local System primary impact

• DET0380 Detection of Local Data Collection Prior to Exfiltration
  AN1070 Windows

  Adversaries collecting local files via PowerShell, WMI, or direct file API calls often include recursive file listings, targeted file reads, and temporary file staging.

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  Tunable: TargetFilePathRegex ParentProcessFilter
  AN1071 Linux

  Adversaries using bash scripts or tools to recursively enumerate user home directories, config files, or SSH keys.

  auditd:SYSCALL open → DC0055 File Access

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: TimeWindow ScriptToolName
  AN1072 macOS

  Adversary use of bash/zsh or AppleScript to locate files and exfil targets like user keychains or documents.

  macos:unifiedlog process:spawn → DC0032 Process Creation

  fs:fsusage read/write → DC0055 File Access

  Tunable: UserContext TargetVolume
  AN1073 Network Devices

  Collection of device configuration via CLI commands (e.g., show running-config, copy flash, more), often followed by TFTP/SCP transfers.

  networkdevice:cli command logging → DC0064 Command Execution

  Tunable: CommandScope AuthenticatedUserList
  AN1074 ESXi

  Adversaries accessing datastore or configuration files via vim-cmd, esxcli, or SCP to extract logs, VMs, or host configurations.

  esxis:vmkernel Datastore Access → DC0055 File Access

  esxi:hostd Command Execution → DC0064 Command Execution

  Tunable: AccessPathRegex InteractiveShellUsage

Sigma rules tagged attack.t1005 (14)

T1212 Exploitation for Credential Access exploitation technique

• DET0174 Detection Strategy for Exploitation for Credential Access
  AN0493 Windows

  Detects adversary exploitation of authentication mechanisms or credential validation processes. Defender perspective includes forged Kerberos tickets (e.g., MS14-068), abnormal LSASS memory access, replayed authentication attempts, and unexpected crashes of authentication services. Multi-event correlation ties exploitation attempts to abnormal process creation, service instability, and suspicious authentication events.

  WinEventLog:Security EventCode=4768, 4769, 4770 → DC0002 User Account Authentication

  WinEventLog:Sysmon EventCode=10 → DC0035 Process Access

  Tunable: MonitoredAccounts ReplayDetectionWindow
  AN0494 Linux

  Detects exploitation of authentication daemons or PAM modules. Defender perspective includes failed or anomalous PAM authentications, abnormal segfaults in authentication services, and exploitation attempts followed by successful unauthorized logins. Correlation identifies memory corruption, replay attempts, and privilege escalation tied to credential services.

  auditd:SYSCALL execve: Suspicious binaries or scripts interacting with authentication binaries (sshd, gdm, login) → DC0032 Process Creation

  NSM:Connections Repeated failed authentication attempts or replay patterns → DC0002 User Account Authentication

  Tunable: AuthServiceList FailureThreshold
  AN0495 macOS

  Detects exploitation attempts against macOS authentication frameworks such as OpenDirectory or Keychain. Defender perspective includes abnormal crashes in opendirectoryd, unauthorized Keychain API usage, and unusual sudo or login events. Correlation links unexpected process behavior with credential access anomalies.

  macos:unifiedlog opendirectoryd crashes or abnormal authentication errors → DC0038 Application Log Content

  macos:osquery execve: Processes unexpectedly invoking Keychain or authentication APIs → DC0032 Process Creation

  Tunable: WatchedAPIs CrashCorrelationWindow
  AN0496 Identity Provider

  Detects exploitation of vulnerabilities in cloud identity providers (IdPs) such as Azure AD or Okta for credential access. Defender perspective includes anomalous token creation or renewal, authentication bypass events, and API abuse to mint unauthorized tokens. Correlation highlights exploitation attempts tied to absent or inconsistent audit logs.

  azure:signinlogs TokenIssued, TokenRenewed: Unexpected or anomalous token issuance events → DC0002 User Account Authentication

  m365:unified ConsentGranted: Abuse of application integrations to mint tokens bypassing MFA → DC0038 Application Log Content

  Tunable: TokenAnomalyThreshold MonitoredAppIntegrations

Sigma rules tagged attack.t1212 (5)

T1555 Credentials from Password Stores primary impact

• DET0430 Detect Credentials Access from Password Stores
  AN1198 Windows

  Monitors suspicious access to password stores such as LSASS, DPAPI, Windows Credential Manager, or browser credential databases. Detects anomalous process-to-process access (e.g., Mimikatz accessing LSASS) and correlation of credential store file reads with execution of non-standard processes.

  WinEventLog:Sysmon EventCode=10 → DC0035 Process Access

  WinEventLog:Security EventCode=4663, 4670, 4656 → DC0055 File Access

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: TargetProcesses KeywordPatterns
  AN1199 Linux

  Detects access to known password store files (e.g., /etc/shadow, GNOME Keyring, KWallet, browser credential databases). Monitors anomalous process read attempts and suspicious API calls that attempt to extract stored credentials.

  auditd:SYSCALL open/read → DC0055 File Access

  auditd:EXECVE execve → DC0032 Process Creation

  Tunable: MonitoredFiles SuspiciousCommands
  AN1200 macOS

  Monitors Keychain database access and suspicious invocations of security and osascript utilities. Correlates process execution with attempts to dump or unlock Keychain data.

  macos:unifiedlog access to keychain database → DC0055 File Access

  macos:unifiedlog execution of security or osascript → DC0032 Process Creation

  Tunable: AllowedApplications AlertThreshold
  AN1201 IaaS

  Detects attempts to access or enumerate cloud password/secrets storage services such as AWS Secrets Manager, Azure Key Vault, or GCP Secret Manager. Monitors API calls for abnormal enumeration or bulk retrieval of secrets.

  AWS:CloudTrail GetSecretValue → DC0083 Cloud Service Enumeration

  AWS:CloudTrail Decrypt → DC0021 OS API Execution

  Tunable: UserContext AccessThreshold

Sigma rules tagged attack.t1555 (8)