Release notes for update package 1822-5242

This update package improves the detection capabilities of the Forcepoint NGFW system.

RELEASE DATE:	Friday January 10, 2025
MD5 CHECKSUM:	b9e6a3748a8c4eeeaea84da5f5f42851
SHA1 CHECKSUM:	5c643e84f4a8f464e2efa136dc04cd7a757112df
SHA256 CHECKSUM:	9ac68722882c0d0c372b0d26a13dcd5d7fc57c0c9146661bb994a6571f00c618

UPDATE CRITICALITY: HIGH

MINIMUM SOFTWARE VERSIONS

- Forcepoint NGFW Security Management Center:	6.10.1.11125
- Forcepoint NGFW:	6.8.1.24103

List of detected attacks in this update package:

Risk level	Description	Reference	Vulnerability
High	An attempt to exploit a vulnerability in Cacti Group Cacti detected	CVE-2024-43364	Cacti-Links.php-Title-Stored-Cross-Site-Scripting
High	An attempt to exploit a vulnerability in Microsoft Windows detected	CVE-2024-38140	Microsoft-Windows-Pragmatic-General-Multicast-Allocatedatabuffer-Use-After-Free
High	An attempt to exploit a vulnerability in Linux Kernel detected	CVE-2024-36886	Linux-Kernel-TIPC-Fragment-Handling-Use-After-Free-CVE-2024-36886
High	An attempt to exploit a vulnerability in Ivanti Endpoint Manager detected	CVE-2024-34779	Ivanti-Endpoint-Manager-Servermemory-Loadmoduletable-SQL-Injection
High	An attempt to exploit a vulnerability in Ivanti Endpoint Manager detected	CVE-2024-32848	Ivanti-Endpoint-Manager-Serverasset-Updateassetinfo-SQL-Injection
High	An attempt to exploit a vulnerability in Palo Alto Expedition	CVE-2024-9463	Palo-Alto-Expedition-Command-Injection-CVE-2024-9463
High	An attempt to exploit a vulnerability in VICIdial detected	CVE-2024-8504	VICIDIAL-Authenticated-Remote-Code-Execution
High	An attempt to exploit a vulnerability in OpenNMS detected	CVE-2023-40315	OpenNMS-Privilege-Escalation-CVE-2023-40315
High	An attempt to exploit a vulnerability in OpenNMS detected	CVE-2023-40315	OpenNMS-Privilege-Escalation-CVE-2023-40315
High	An attempt to exploit a vulnerability in Selenium Grid detected	CVE-2022-28108	Selenium-Chrome-RCE
High	An attempt to exploit a vulnerability in Cisco IOS detected	CVE-2017-6736	Cisco-IOS-And-IOS-XE-Buffer-Overflow-CVE-2017-6736

Jump to: Detected Attacks Other Changes

DETECTED ATTACKS

New detected attacks:

UDP Packet Unknown

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Linux-Kernel-TIPC-Fragment-Handling-Use-After-Free-CVE-2024-36886	CVE-2024-36886	Generic_UDP-Linux-Kernel-TIPC-Fragment-Handling-Use-After-Free-CVE-2024-36886	Potential Compromise

HTTP Request URI

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Ivanti-Endpoint-Manager-Servermemory-Loadmoduletable-SQL-Injection	CVE-2024-34779	HTTP_CSU-Ivanti-Endpoint-Manager-Servermemory-Loadmoduletable-SQL-Injection	Suspected Compromise

SNMP UDP Client Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Cisco-IOS-And-IOS-XE-Buffer-Overflow-CVE-2017-6736	CVE-2017-6736	SNMP-UDP_Cisco-IOS-And-IOS-XE-Buffer-Overflow-CVE-2017-6736	Potential Compromise

HTTP Normalized Request-Line

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	VICIDIAL-Authenticated-Remote-Code-Execution	CVE-2024-8504	HTTP_CRL-VICIDIAL-Authenticated-Remote-Code-Execution	Suspected Compromise
High	Selenium-Chrome-RCE	CVE-2022-28108	HTTP_CRL-Selenium-Chrome-RCE	Suspected Compromise
High	Ivanti-Endpoint-Manager-Serverasset-Updateassetinfo-SQL-Injection	CVE-2024-32848	HTTP_CRL-Ivanti-Endpoint-Manager-Serverasset-Updateassetinfo-SQL-Injection	Suspected Compromise
High	Cacti-Links.php-Title-Stored-Cross-Site-Scripting	CVE-2024-43364	HTTP_CRL-Cacti-Links.php-Title-Stored-Cross-Site-Scripting	Suspected Compromise
High	Palo-Alto-Expedition-Command-Injection-CVE-2024-9463	CVE-2024-9463	HTTP_CRL-Palo-Alto-Expedition-Command-Injection-CVE-2024-9463	Potential Compromise

Text File Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	OpenNMS-Privilege-Escalation-CVE-2023-40315	CVE-2023-40315	File-Text_OpenNMS-Authenticated-Remote-Code-Execution	Suspected Compromise

Identified Text File Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	OpenNMS-Privilege-Escalation-CVE-2023-40315	CVE-2023-40315	File-TextId_OpenNMS-Authenticated-Remote-Code-Execution	Suspected Compromise

Generic IP Fingerprinting Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Microsoft-Windows-Pragmatic-General-Multicast-Allocatedatabuffer-Use-After-Free	CVE-2024-38140	IPv4_Microsoft-Windows-Pragmatic-General-Multicast-Allocatedatabuffer-Use-After-Free	Suspected Compromise

Updated detected attacks:

HTTP Client Stream

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Oracle-WebLogic-Server-Workcontextxmlinputadapter-Insecure-Deserialization

CVE-2017-10271

HTTP_CS-Oracle-WebLogic-Server-Workcontextxmlinputadapter-Insecure-Deserialization

Suspected Compromise

Description has changed

High

Cyberpanel-Remote-Code-Execution-CVE-2024-51567

CVE-2024-51567

HTTP_CS-Cyberpanel-Getresetstatus-Command-Injection

Suspected Compromise

Name: HTTP_CS-Cyberpanel-Remote-Code-Execution-CVE-2024-51567->HTTP_CS-Cyberpanel-Getresetstatus-Command-Injection

Fingerprint regexp changed

TCP Client Stream Unknown

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Ysoserial-Generated-Java-Serialized-Object

No CVE/CAN

Generic_CS-Suspicious-Java-Serialized-Object

Suspected Compromise

Description has changed

Category tag group CVE2016 added

High

Ivanti-Avalanche-Wlavalancheservice.exe-Type-101-102-Null-Pointer-Dereference

CVE-2024-47007

Generic_CS-Ivanti-Avalanche-Wlavalancheservice.exe-Type-101-102-Null-Pointer-Dereference

Suspected Compromise

Description has changed

HTTP Request URI

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

NetGear-R7000-And-R6400-Cgi-Bin-Command-Injection

CVE-2016-6277

HTTP_CSU-Cgi-Bin-Command-Injection

Suspected Compromise

Fingerprint regexp changed

High

D-Link-DSL-2750B-Command-Injection

CVE-2016-20017

HTTP_CSU-D-Link-DSL-2750B-Command-Injection

Suspected Compromise

Fingerprint regexp changed

High

Ray-OS-Command-Injection-Via-Format-Parameter-CVE-2023-6019

CVE-2023-6019

HTTP_CSU-Ray-OS-Command-Injection-Via-Format-Parameter-CVE-2023-6019

Suspected Compromise

Fingerprint regexp changed

HTTP Request Header Line

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

D-Link-HNAP-SOAPAction-Header-Command-Execution

CVE-2015-2051

HTTP_CSH-D-Link-HNAP-SOAPAction-Header-Command-Execution

Suspected Compromise

Fingerprint regexp changed

HTTP Normalized Request-Line

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Geutebruck-Multiple-RCE-CVE-2021-335xx

CVE-2021-33543

HTTP_CRL-Geutebruck-Multiple-RCE-CVE-2021-335xx

Suspected Compromise

Fingerprint regexp changed

High

Roundcube-Webmail-RCE-Via-Config-Setting-CVE-2020-12641

CVE-2020-12641

HTTP_CRL-Roundcube-Webmail-ECE-Via-Config-Setting-CVE-2020-12641

Suspected Compromise

Fingerprint regexp changed

High

LG-N1A1-NAS-Remote-Command-Execution-CVE-2018-14839

CVE-2018-14839

HTTP_CRL-LG-N1A1-NAS-Remote-Command-Execution-CVE-2018-14839

Suspected Compromise

Fingerprint regexp changed

High

Sunhillo-Sureline-Command-Injection-CVE-2021-36380

CVE-2021-36380

HTTP_CRL-Sunhillo-Sureline-Command-Injection-CVE-2021-36380

Suspected Compromise

Fingerprint regexp changed

High

Korenix-Jetwave-Command-Injection-CVE-2023-23294

CVE-2023-23294

HTTP_CRL-Korenix-Jetwave-Command-Injection-CVE-2023-23294

Suspected Compromise

Fingerprint regexp changed

High

VMware-SD-WAN-Edge-Command-Injection-Vulnerability-CVE-2018-6961

CVE-2018-6961

HTTP_CRL-VMware-SD-WAN-Edge-Command-Injection-Vulnerability-CVE-2018-6961

Suspected Compromise

Fingerprint regexp changed

High

Netgate-Pfsense-Command-Injection-CVE-2023-42326

CVE-2023-42326

HTTP_CRL-Netgate-Pfsense-Command-Injection-CVE-2023-42326

Suspected Compromise

Fingerprint regexp changed

High

FXC-AE1021PE-Router-Command-Injection-CVE-2023-49897

CVE-2023-49897

HTTP_CRL-FXC-AE1021PE-Router-Command-Injection-CVE-2023-49897

Suspected Compromise

Fingerprint regexp changed

High

LB-Link-Command-Injection-CVE-2023-26801

CVE-2023-26801

HTTP_CRL-LB-Link-Command-Injection-CVE-2023-26801

Suspected Compromise

Fingerprint regexp changed

High

Avtech-IP-Camera-AVM1203-Command-Injection-CVE-2024-7029

CVE-2024-7029

HTTP_CRL-Avtech-IP-Camera-AVM1203-Command-Injection-CVE-2024-7029

Suspected Compromise

Fingerprint regexp changed

High

Avtech-IP-Camera-Multiple-Command-Injection-Vulnerabilities

No CVE/CAN

HTTP_CRL-Avtech-IP-Camera-Multiple-Command-Injection-Vulnerabilities

Suspected Compromise

Fingerprint regexp changed

High

Palo-Alto-Expedition-OS-Command-Injection-CVE-2024-9464

CVE-2024-9464

HTTP_CRL-Palo-Alto-Expedition-OS-Command-Injection-CVE-2024-9464

Suspected Compromise

Fingerprint regexp changed

High

VHD-PTZ-Camera-Firmware-Command-Injection-CVE-2024-8957

CVE-2024-8957

HTTP_CRL-VHD-PTZ-Camera-Firmware-Command-Injection-CVE-2024-8957

Suspected Compromise

Fingerprint regexp changed

High

Palo-Alto-SSLVPN-Command-Execution-CVE-2024-9474

CVE-2024-9474

HTTP_CRL-Palo-Alto-SSLVPN-Command-Execution-CVE-2024-9474

Suspected Compromise

Fingerprint regexp changed

High

LibreNMS-Authenticated-Command-Injection-CVE-2024-51092

CVE-2024-51092

HTTP_CRL-LibreNMS-Authenticated-Command-Injection-CVE-2024-51092

Suspected Compromise

Fingerprint regexp changed

High

Digiever-DS2105-Pro-Remote-Code-Execution

No CVE/CAN

HTTP_CRL-Digiever-DS2105-Pro-Remote-Code-Execution

Suspected Compromise

Fingerprint regexp changed

High

Teltonika-RUT9XX-Router-OS-Command-Injection-CVE-2018-17532

CVE-2018-17532

HTTP_CRL-Teltonika-RUT9XX-Router-OS-Command-Injection-CVE-2018-17532

Suspected Compromise

Fingerprint regexp changed

High

Four-Faith-Routers-F3x24-F3x36-Remote-Command-Injection-CVE-2024-12856

CVE-2024-12856

HTTP_CRL-Four-Faith-Routers-F3x24-F3x36-Remote-Command-Injection-CVE-2024-12856

Suspected Compromise

Fingerprint regexp changed

High

D-Link-TRENDnet-NCC-Service-Command-Injection

CVE-2015-1187

HTTP_CRL-D-Link-TRENDnet-NCC-Service-Command-Injection

Suspected Compromise

Fingerprint regexp changed

High

Pfsense-Post-Auth-Group-Member-Command-Execution

No CVE/CAN

HTTP_CRL-Pfsense-Post-Auth-Group-Member-Command-Execution

Suspected Compromise

Fingerprint regexp changed

LIST OF OTHER CHANGES:

New objects:

Type	Name
Category	Selenium Grid
Category	OpenNMS Horizon
Situation	Persistent_CRL_Cache-Event
Situation	Persistent_CRL_Cache-Error
Element Ref	Application dependency from Azure-Stack-HCI to Microsoft-Active-Protection-Service

Updated objects:

Type

Name

Changes

Situation

URL_List-DNS-Over-HTTPS

Detection mechanism updated

IPList

TOR exit nodes IP Address List

IPList

Amazon AMAZON

IPList

Amazon EC2

IPList

TOR relay nodes IP Address List

IPList

NordVPN Servers IP Address List

IPList

Amazon AMAZON ap-southeast-2

IPList

Forcepoint Drop IP Address List

IPList

Amazon AMAZON us-west-2

IPList

Amazon EC2 us-west-2

Situation

HTTP_PSU-Shared-Variables

Fingerprint regexp changed

Application

TOR

Application

DNS-Over-HTTPS

Application

NordVPN

HOW TO IMPORT AND ACTIVATE THE DYNAMIC UPDATE PACKAGE

Download the dynamic update package, then make sure that the checksums for the original files and the files that you have downloaded match.
In the Management Client, select Menu > File > Import > Import Update Packages.
Browse to the file, select it, then click Import.
Select Configuration, then browse to Administration > Other Elements > Updates.
Right-click the imported dynamic update package, then select Activate.
When the activation is finished, refresh the policy on all NGFW Engines. If your policy uses a custom template, you might need to edit the policy.

DISCLAIMER AND COPYRIGHT

Copyright © 2025 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.

All other trademarks used in this document are the property of their respective owners.

Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.