Release notes for update package 1842-5242

This update package improves the detection capabilities of the Forcepoint NGFW system.

RELEASE DATE:	Thursday February 27, 2025
MD5 CHECKSUM:	efff71e764821369b740fb5b7883f90b
SHA1 CHECKSUM:	36724f5c1aa5948e8c09c4e617efe075a0de4bfe
SHA256 CHECKSUM:	4141542de6c5be3601a111a3e55c9ee291f24f2dfa34910b77a7b28c5803fc5b

UPDATE CRITICALITY: HIGH

MINIMUM SOFTWARE VERSIONS

- Forcepoint NGFW Security Management Center:	6.10.1.11125
- Forcepoint NGFW:	6.8.1.24103

List of detected attacks in this update package:

Risk level	Description	Reference	Vulnerability
High	An attempt to exploit a vulnerability in Microsoft Windows Server	CVE-2024-38258	Windows-Remote-Desktop-Licensing-Service-Information-Disclosure-Vulnerability
High	An attempt to exploit a vulnerability in InvokeAI detected	CVE-2024-12029	InvokeAI-RCE
High	An attempt to exploit a vulnerability in Adminer detected	CVE-2021-43008	Adminer-Remote-Arbitrary-File-Read-CVE-2021-43008

Jump to: Detected Attacks Other Changes

DETECTED ATTACKS

New detected attacks:

MSRPC Client Payload Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Windows-Remote-Desktop-Licensing-Service-Information-Disclosure-Vulnerability	CVE-2024-38258	MSRPC-TCP_CPS-Windows-Remote-Desktop-Licensing-Service-Information-Disclosure-Vulnerability	Suspected Compromise

HTTP Normalized Request-Line

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Adminer-Remote-Arbitrary-File-Read-CVE-2021-43008	CVE-2021-43008	HTTP_CRL-Adminer-Remote-Arbitrary-File-Read-CVE-2021-43008	Suspected Compromise

Text File Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	InvokeAI-RCE	CVE-2024-12029	File-Text_InvokeAI-RCE	Suspected Compromise

Updated detected attacks:

HTTP Request URI

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Node.js-Systeminformation-Library-Command-Injection-CVE-2021-21315

CVE-2021-21315

HTTP_CSU-Node.js-Systeminformation-Library-Command-Injection-CVE-2021-21315

Suspected Compromise

Name: HTTP_CSU-Node.js-Systeminformation-Command-Injection-CVE-2021-21315->HTTP_CSU-Node.js-Systeminformation-Library-Command-Injection-CVE-2021-21315

HTTP Normalized Request-Line

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Xwiki-Solrsearchmacros-Text-Code-Injection

CVE-2025-24893

HTTP_CRL-Xwiki-Solrsearchmacros-Text-Code-Injection

Suspected Compromise

Comment has changed

High

Xwiki.org-Xwiki-TextAreaClass-displayView-Code-Injection

CVE-2023-26475

HTTP_CRL-Xwiki.org-Xwiki-TextAreaClass-displayView-Code-Injection

Suspected Compromise

Comment has changed

Other Binary File Stream

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Ysoserial-Generated-Java-Serialized-Object

No CVE/CAN

File-Binary_Suspicious-Java-Serialized-Object

Suspected Compromise

Fingerprint regexp changed

LIST OF OTHER CHANGES:

New objects:

Type	Name
Category	InvokeAI
Category	Adminer
Vulnerability Reference System	SecurityFocus

Updated objects:

Type	Name	Changes
IPList	Somalia
IPList	Yemen
IPList	Iraq
IPList	Saudi Arabia
IPList	Iran
IPList	Cyprus
IPList	Tanzania
IPList	Armenia
IPList	Kenya
IPList	DR Congo
IPList	Uganda
IPList	Seychelles
IPList	Kuwait
IPList	Oman
IPList	United Arab Emirates
IPList	Israel
IPList	Türkiye
IPList	Egypt
IPList	Sudan
IPList	Greece
IPList	Burundi
IPList	Estonia
IPList	Latvia
IPList	Azerbaijan
IPList	Lithuania
IPList	Svalbard and Jan Mayen
IPList	Georgia
IPList	Belarus
IPList	Finland
IPList	Ukraine
IPList	Hungary
IPList	Bulgaria
IPList	Albania
IPList	Poland
IPList	Romania
IPList	Kosovo
IPList	Zimbabwe
IPList	Zambia
IPList	Malawi
IPList	Mauritius
IPList	Réunion
IPList	South Africa
IPList	Mayotte
IPList	Mozambique
IPList	Afghanistan
IPList	Pakistan
IPList	Bangladesh
IPList	Sri Lanka
IPList	Bhutan
IPList	India
IPList	Maldives
IPList	Nepal
IPList	Myanmar
IPList	Uzbekistan
IPList	Kazakhstan
IPList	Kyrgyzstan
IPList	Palau
IPList	Vietnam
IPList	Thailand
IPList	Indonesia
IPList	Laos
IPList	Taiwan
IPList	Philippines
IPList	Malaysia
IPList	China
IPList	Hong Kong
IPList	Brunei
IPList	Macao
IPList	Cambodia
IPList	South Korea
IPList	Japan
IPList	Singapore
IPList	Russia
IPList	Mongolia
IPList	Australia
IPList	Christmas Island
IPList	Papua New Guinea
IPList	Nauru
IPList	New Zealand
IPList	Congo Republic
IPList	Portugal
IPList	Ivory Coast
IPList	Ghana
IPList	Equatorial Guinea
IPList	Nigeria
IPList	Guinea-Bissau
IPList	Mauritania
IPList	Sierra Leone
IPList	Gibraltar
IPList	Niger
IPList	Spain
IPList	Morocco
IPList	Malta
IPList	Algeria
IPList	Denmark
IPList	United Kingdom
IPList	Switzerland
IPList	Sweden
IPList	The Netherlands
IPList	Austria
IPList	Belgium
IPList	Germany
IPList	Luxembourg
IPList	Ireland
IPList	France
IPList	Andorra
IPList	Czechia
IPList	Norway
IPList	Vatican City
IPList	San Marino
IPList	Italy
IPList	Slovenia
IPList	Croatia
IPList	Bosnia and Herzegovina
IPList	Angola
IPList	Namibia
IPList	Barbados
IPList	French Guiana
IPList	Paraguay
IPList	Brazil
IPList	Dominican Republic
IPList	Bahamas
IPList	Trinidad and Tobago
IPList	Antigua and Barbuda
IPList	St Vincent and Grenadines
IPList	Saint Martin
IPList	Saint Barthélemy
IPList	Guadeloupe
IPList	Grenada
IPList	Cayman Islands
IPList	El Salvador
IPList	Guatemala
IPList	Venezuela
IPList	Ecuador
IPList	Colombia
IPList	Panama
IPList	Argentina
IPList	Peru
IPList	Mexico
IPList	Guam
IPList	Puerto Rico
IPList	U.S. Virgin Islands
IPList	American Samoa
IPList	Canada
IPList	United States
IPList	Serbia
IPList	Antarctica
IPList	TOR exit nodes IP Address List
IPList	Amazon AMAZON
IPList	Amazon EC2
IPList	TOR relay nodes IP Address List
IPList	Botnet IP Address List
IPList	Malicious Site IP Address List
IPList	NordVPN Servers IP Address List
IPList	Zoho Meeting Servers
IPList	Amazon AMAZON us-east-1
IPList	Amazon EC2 us-east-1
IPList	Amazon AMAZON eusc-de-east-1
IPList	Forcepoint Drop IP Address List
IPList	Amazon AMAZON us-west-2
IPList	Amazon EC2 us-west-2
Application	TOR
Application	NordVPN
Application	Zoho-Meeting-App

HOW TO IMPORT AND ACTIVATE THE DYNAMIC UPDATE PACKAGE

Download the dynamic update package, then make sure that the checksums for the original files and the files that you have downloaded match.
In the Management Client, select Menu > File > Import > Import Update Packages.
Browse to the file, select it, then click Import.
Select Configuration, then browse to Administration > Other Elements > Updates.
Right-click the imported dynamic update package, then select Activate.
When the activation is finished, refresh the policy on all NGFW Engines. If your policy uses a custom template, you might need to edit the policy.

DISCLAIMER AND COPYRIGHT

Copyright © 2025 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.

All other trademarks used in this document are the property of their respective owners.

Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.