Release notes for update package 1824-5242

This update package improves the detection capabilities of the Forcepoint NGFW system.

RELEASE DATE:	Tuesday January 14, 2025
MD5 CHECKSUM:	5761e81b41fe8e56561ecbc6d98cb683
SHA1 CHECKSUM:	43fe38f8b04e21e0709b9f1ced77d94fdc347d10
SHA256 CHECKSUM:	5abe1752bba39d324ffd1f62b4b889e93a9b603fa81b70db3cc2a86945de4ad9

UPDATE CRITICALITY: HIGH

MINIMUM SOFTWARE VERSIONS

- Forcepoint NGFW Security Management Center:	6.10.1.11125
- Forcepoint NGFW:	6.8.1.24103

List of detected attacks in this update package:

Risk level	Description	Reference	Vulnerability
High	An attempt to exploit a vulnerability in Microsoft Office detected	CVE-2025-21365	Microsoft-Office-Remote-Code-Execution-CVE-2025-21365
High	An attempt to exploit a vulnerability in Microsoft Windows detected	CVE-2025-21269	Windows-HTML-Platforms-Security-Feature-Bypass-CVE-2025-21269
High	An attempt to exploit a vulnerability in Microsoft Windows detected	CVE-2025-21269	Windows-HTML-Platforms-Security-Feature-Bypass-CVE-2025-21269
High	An attempt to exploit a vulnerability in Microsoft Windows detected	CVE-2025-21268	Microsoft-Windows-Mapurltozone-Security-Feature-Bypass-CVE-2025-21268
High	An attempt to exploit a vulnerability in Microsoft Windows detected	CVE-2025-21219	Microsoft-Windows-Mapurltozone-Security-Feature-Bypass-CVE-2025-21219
High	An attempt to exploit a vulnerability in Microsoft Windows detected	CVE-2025-21219	Microsoft-Windows-Mapurltozone-Security-Feature-Bypass-CVE-2025-21219
High	An attempt to exploit a vulnerability in Microsoft Windows detected	CVE-2025-21219	Microsoft-Windows-Mapurltozone-Security-Feature-Bypass-CVE-2025-21219
High	An attempt to exploit a vulnerability in Microsoft Windows detected	CVE-2025-21189	Microsoft-Windows-Mapurltozone-Security-Feature-Bypass-CVE-2025-21189
High	An attempt to exploit a vulnerability in Microsoft Windows detected	CVE-2025-21189	Microsoft-Windows-Mapurltozone-Security-Feature-Bypass-CVE-2025-21189
High	An attempt to exploit a vulnerability in Microsoft Windows detected	CVE-2025-21189	Microsoft-Windows-Mapurltozone-Security-Feature-Bypass-CVE-2025-21189
High	An attempt to exploit a vulnerability in Netis routers	CVE-2024-48456	Netis-Router-Unauthenticated-Password-Change
High	An attempt to exploit a vulnerability in Pandora FMS detected	CVE-2024-11320	Pandora-FMS-Authenticated-Command-Injection-CVE-2024-11320
High	An attempt to exploit a vulnerability in AJ-Report detected	CVE-2024-7314	AJ-Report-Authentication-Bypass-CVE-2024-7314
High	An attempt to exploit a vulnerability in AJ-Report detected	CVE-2024-7314	AJ-Report-Authentication-Bypass-CVE-2024-7314

Jump to: Detected Attacks Other Changes

DETECTED ATTACKS

New detected attacks:

HTTP Normalized Request-Line

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	AJ-Report-Authentication-Bypass-CVE-2024-7314	CVE-2024-7314	HTTP_CRL-AJ-Report-Remote-Code-Execution-CVE-2024-7314	Suspected Compromise
High	AJ-Report-Authentication-Bypass-CVE-2024-7314	CVE-2024-7314	HTTP_CRL-AJ-Report-Potential-Authentication-Bypass-CVE-2024-7314	Potential Compromise
High	Netis-Router-Unauthenticated-Password-Change	CVE-2024-48456	HTTP_CRL-Netis-Router-Unauthenticated-Password-Change	Potential Compromise
High	Pandora-FMS-Authenticated-Command-Injection-CVE-2024-11320	CVE-2024-11320	HTTP_CRL-Pandora-FMS-Authenticated-Command-Injection-CVE-2024-11320	Suspected Compromise

Text File Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Microsoft-Windows-Mapurltozone-Security-Feature-Bypass-CVE-2025-21189	CVE-2025-21189	File-Text_Microsoft-Windows-Mapurltozone-Security-Feature-Bypass-CVE-2025-21189	Potential Compromise
High	Microsoft-Windows-Mapurltozone-Security-Feature-Bypass-CVE-2025-21189	CVE-2025-21189	File-Text_Microsoft-Windows-Mapurltozone-Security-Feature-Bypass-CVE-2025-21189-2	Suspected Compromise
High	Microsoft-Windows-Mapurltozone-Security-Feature-Bypass-CVE-2025-21219	CVE-2025-21219	File-Text_Microsoft-Windows-Mapurltozone-Security-Feature-Bypass-CVE-2025-21219	Potential Compromise
High	Microsoft-Windows-Mapurltozone-Security-Feature-Bypass-CVE-2025-21219	CVE-2025-21219	File-Text_Microsoft-Windows-Mapurltozone-Security-Feature-Bypass-CVE-2025-21219-2	Suspected Compromise
High	Microsoft-Windows-Mapurltozone-Security-Feature-Bypass-CVE-2025-21268	CVE-2025-21268	File-Text_Microsoft-Windows-Mapurltozone-Security-Feature-Bypass-CVE-2025-21268	Potential Compromise
High	Windows-HTML-Platforms-Security-Feature-Bypass-CVE-2025-21269	CVE-2025-21269	File-Text_Windows-HTML-Platforms-Security-Feature-Bypass-CVE-2025-21269	Potential Compromise

Other Binary File Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Microsoft-Windows-Mapurltozone-Security-Feature-Bypass-CVE-2025-21189	CVE-2025-21189	File-Binary_Microsoft-Windows-Mapurltozone-Security-Feature-Bypass-CVE-2025-21189	Potential Compromise
High	Microsoft-Windows-Mapurltozone-Security-Feature-Bypass-CVE-2025-21219	CVE-2025-21219	File-Binary_Microsoft-Windows-Mapurltozone-Security-Feature-Bypass-CVE-2025-21219	Potential Compromise
High	Windows-HTML-Platforms-Security-Feature-Bypass-CVE-2025-21269	CVE-2025-21269	File-Binary_Windows-HTML-Platforms-Security-Feature-Bypass-CVE-2025-21269	Potential Compromise

Zip File Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Microsoft-Office-Remote-Code-Execution-CVE-2025-21365	CVE-2025-21365	File-Zip_Microsoft-Office-Remote-Code-Execution-CVE-2025-21365	Potential Compromise

Updated detected attacks:

UDP Packet Unknown

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Linux-Kernel-TIPC-Fragment-Handling-Use-After-Free-CVE-2024-36886

CVE-2024-36886

Generic_UDP-Linux-Kernel-TIPC-Fragment-Handling-Use-After-Free-CVE-2024-36886

Potential Compromise

Detection mechanism updated

TCP Client Stream Unknown

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Apache-Couchdb-Erlang-RCE

CVE-2022-24706

Generic_CS-Apache-Couchdb-Erlang-RCE

Suspected Compromise

Fingerprint regexp changed

LIST OF OTHER CHANGES:

New objects:

Type	Name
Category	AJ-Report
Category	MS2025
Category	MS2025-01
Category	CVE2025
Situation	Analyzer_WebSocket-Connection-Flood

Updated objects:

Type

Name

Changes

Situation

URL_List-DNS-Over-HTTPS

Detection mechanism updated

IPList

Rwanda

IPList

Somalia

IPList

Yemen

IPList

Iraq

IPList

Saudi Arabia

IPList

Iran

IPList

Cyprus

IPList

Tanzania

IPList

Armenia

IPList

Kenya

IPList

DR Congo

IPList

Uganda

IPList

Seychelles

IPList

Jordan

IPList

Lebanon

IPList

Kuwait

IPList

Oman

IPList

Qatar

IPList

Bahrain

IPList

United Arab Emirates

IPList

Israel

IPList

Türkiye

IPList

Egypt

IPList

Greece

IPList

Estonia

IPList

Latvia

IPList

Azerbaijan

IPList

Lithuania

IPList

Svalbard and Jan Mayen

IPList

Georgia

IPList

Moldova

IPList

Belarus

IPList

Finland

IPList

Ukraine

IPList

North Macedonia

IPList

Hungary

IPList

Bulgaria

IPList

Albania

IPList

Poland

IPList

Romania

IPList

Zambia

IPList

Malawi

IPList

Botswana

IPList

Mauritius

IPList

Réunion

IPList

South Africa

IPList

Mayotte

IPList

Mozambique

IPList

Madagascar

IPList

Afghanistan

IPList

Pakistan

IPList

Bangladesh

IPList

Turkmenistan

IPList

Tajikistan

IPList

Sri Lanka

IPList

Bhutan

IPList

India

IPList

Maldives

IPList

Nepal

IPList

Myanmar

IPList

Uzbekistan

IPList

Kazakhstan

IPList

Kyrgyzstan

IPList

Palau

IPList

Vietnam

IPList

Thailand

IPList

Indonesia

IPList

Laos

IPList

Taiwan

IPList

Philippines

IPList

Malaysia

IPList

China

IPList

Hong Kong

IPList

Brunei

IPList

Macao

IPList

Cambodia

IPList

South Korea

IPList

Japan

IPList

North Korea

IPList

Singapore

IPList

Russia

IPList

Mongolia

IPList

Australia

IPList

Christmas Island

IPList

Papua New Guinea

IPList

New Zealand

IPList

Fiji

IPList

Cameroon

IPList

Senegal

IPList

Portugal

IPList

Ivory Coast

IPList

Ghana

IPList

Nigeria

IPList

Burkina Faso

IPList

Sierra Leone

IPList

Gibraltar

IPList

Western Sahara

IPList

Tunisia

IPList

Spain

IPList

Morocco

IPList

Malta

IPList

Algeria

IPList

Denmark

IPList

Iceland

IPList

United Kingdom

IPList

Switzerland

IPList

Sweden

IPList

The Netherlands

IPList

Austria

IPList

Belgium

IPList

Germany

IPList

Luxembourg

IPList

Ireland

IPList

Monaco

IPList

France

IPList

Andorra

IPList

Liechtenstein

IPList

Jersey

IPList

Isle of Man

IPList

Guernsey

IPList

Slovakia

IPList

Czechia

IPList

Norway

IPList

Italy

IPList

Slovenia

IPList

Montenegro

IPList

Croatia

IPList

Bosnia and Herzegovina

IPList

Angola

IPList

Namibia

IPList

Barbados

IPList

Guyana

IPList

French Guiana

IPList

Greenland

IPList

Paraguay

IPList

Uruguay

IPList

Brazil

IPList

Falkland Islands

IPList

Jamaica

IPList

Dominican Republic

IPList

Martinique

IPList

Bahamas

IPList

Bermuda

IPList

Anguilla

IPList

Trinidad and Tobago

IPList

St Kitts and Nevis

IPList

Dominica

IPList

Antigua and Barbuda

IPList

Saint Lucia

IPList

Aruba

IPList

British Virgin Islands

IPList

St Vincent and Grenadines

IPList

Montserrat

IPList

Saint Martin

IPList

Guadeloupe

IPList

Cayman Islands

IPList

Belize

IPList

El Salvador

IPList

Guatemala

IPList

Honduras

IPList

Nicaragua

IPList

Costa Rica

IPList

Venezuela

IPList

Ecuador

IPList

Colombia

IPList

Panama

IPList

Haiti

IPList

Argentina

IPList

Chile

IPList

Bolivia

IPList

Peru

IPList

Mexico

IPList

French Polynesia

IPList

Pitcairn Islands

IPList

Northern Mariana Islands

IPList

Guam

IPList

Puerto Rico

IPList

U.S. Virgin Islands

IPList

Canada

IPList

United States

IPList

Serbia

IPList

Antarctica

IPList

Sint Maarten

IPList

TOR exit nodes IP Address List

IPList

Amazon AMAZON

IPList

Amazon S3

IPList

Amazon EC2

IPList

TOR relay nodes IP Address List

IPList

Amazon AMAZON ap-southeast-1

IPList

Amazon S3 ap-southeast-1

IPList

Amazon EC2 ap-southeast-1

IPList

NordVPN Servers IP Address List

IPList

Google Cloud IP Address List for europe-west12

IPList

Amazon AMAZON eu-west-1

IPList

Amazon S3 eu-west-1

IPList

Amazon EC2 eu-west-1

IPList

Forcepoint Drop IP Address List

IPList

Amazon AMAZON us-west-2

IPList

Amazon EC2 us-west-2

IPList

Google Cloud IP Address List for asia-northeast3

IPList

Google Cloud IP Address List for asia-south2

IPList

Google Cloud IP Address List for europe-west1

IPList

Google Cloud IP Address List for northamerica-northeast2

IPList

Google Cloud IP Address List for southamerica-west1

Situation

File-Zip_Shared-Variables

Situation

File-Member-Name_Shared-Variables

Fingerprint regexp changed

Application

TOR

Application

DNS-Over-HTTPS

Application

NordVPN

HOW TO IMPORT AND ACTIVATE THE DYNAMIC UPDATE PACKAGE

Download the dynamic update package, then make sure that the checksums for the original files and the files that you have downloaded match.
In the Management Client, select Menu > File > Import > Import Update Packages.
Browse to the file, select it, then click Import.
Select Configuration, then browse to Administration > Other Elements > Updates.
Right-click the imported dynamic update package, then select Activate.
When the activation is finished, refresh the policy on all NGFW Engines. If your policy uses a custom template, you might need to edit the policy.

DISCLAIMER AND COPYRIGHT

Copyright © 2025 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.

All other trademarks used in this document are the property of their respective owners.

Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.