Release notes for update package 1877-5242

This update package improves the detection capabilities of the Forcepoint NGFW system.

RELEASE DATE:	Monday May 12, 2025
MD5 CHECKSUM:	e959578c95d45fe129809ac6fa6c5da2
SHA1 CHECKSUM:	b61199ecf4276f5c8a42cc723307aaf6f2428e4b
SHA256 CHECKSUM:	62c247e244ed13af88c45d25f537cb1cad5f09289a7ca7f72618588a3e31a4bd

UPDATE CRITICALITY: HIGH

MINIMUM SOFTWARE VERSIONS

- Forcepoint NGFW Security Management Center:	6.10.1.11125
- Forcepoint NGFW:	6.8.1.24103

List of detected attacks in this update package:

Risk level	Description	Reference	Vulnerability
High	An attempt to exploit a vulnerability in Sonicwall SMA100 series appliances detected	CVE-2025-32819	SonicWall-SMA100-Arbitrary-File-Deletion-CVE-2025-32819
High	An attempt to exploit a vulnerability in Apache Camel detected	CVE-2025-27636	Apache-Camel-Filter-Bypass-CVE-2025-27636
High	An attempt to exploit a vulnerability in SysAid detected	CVE-2025-2778	SysAid-On-Prem-Authenticated-Command-Injection-CVE-2025-2778
High	An attempt to exploit a vulnerability in The GIMP	CVE-2025-2760	Gnu-GIMP-DDS-Image-Parsing-Integer-Overflow-CVE-2025-2760
High	An attempt to exploit a vulnerability in Webkit detected	CVE-2024-54502	Webkit-fontLoadingTimerFired-Use-After-Free-CVE-2024-54502
High	An attempt to exploit a vulnerability in Fortinet FortiSandbox	CVE-2024-52961	Fortinet-FortiSandbox-VM-Download-Command-Injection-CVE-2024-52961
High	An attempt to exploit a vulnerability in OpenSSL detected	CVE-2024-6119	OpenSSL-Name-Check-Denial-Of-Service-CVE-2024-6119
High	An attempt to exploit a vulnerability in a TP-Link device	CVE-2020-9374	TP-Link-Traceroute-Remote-Code-Execution-CVE-2020-9374
High	An attempt to exploit a vulnerability in Rockwell Automation RSLinx Classic detected	CVE-2019-6553	Rockwell-Automation-Rslinx-Classic-Forward-Open-Electronic-Key-Stack-BOF
High	An attempt to exploit a vulnerability in Apache	CVE-2018-11759	Apache-Mod_jk-Access-Control-Bypass-CVE-2018-11759
High	An attempt to exploit a vulnerability in Red Hat RPM resource detected	CVE-2018-1111	Red-Hat-Networkmanager-DHCP-Command-Injection

Jump to: Detected Attacks Other Changes

DETECTED ATTACKS

New detected attacks:

BOOTP Server Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Red-Hat-Networkmanager-DHCP-Command-Injection	CVE-2018-1111	BOOTP_SS-Red-Hat-Networkmanager-DHCP-Command-Injection	Suspected Compromise

TCP Client Stream Unknown

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Rockwell-Automation-Rslinx-Classic-Forward-Open-Electronic-Key-Stack-BOF	CVE-2019-6553	Generic_CS-Rockwell-Automation-Rslinx-Classic-Buffer-Overflow-CVE-2018-14829	Suspected Compromise

HTTP Request URI

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Apache-Mod_jk-Access-Control-Bypass-CVE-2018-11759	CVE-2018-11759	HTTP_CSU-Apache-Mod_jk-Access-Control-Bypass-CVE-2018-11759	Suspected Compromise

HTTP Normalized Request-Line

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Apache-Camel-Filter-Bypass-CVE-2025-27636	CVE-2025-27636	HTTP_CRL-Apache-Camel-Filter-Bypass-CVE-2025-27636	Suspected Compromise
High	Fortinet-FortiSandbox-VM-Download-Command-Injection-CVE-2024-52961	CVE-2024-52961	HTTP_CRL-Fortinet-FortiSandbox-VM-Download-Command-Injection-CVE-2024-52961	Suspected Compromise
High	TP-Link-Traceroute-Remote-Code-Execution-CVE-2020-9374	CVE-2020-9374	HTTP_CRL-TP-Link-Traceroute-Remote-Code-Execution-CVE-2020-9374	Suspected Compromise
High	SonicWall-SMA100-Arbitrary-File-Deletion-CVE-2025-32819	CVE-2025-32819	HTTP_CRL-SonicWall-SMA100-Arbitrary-File-Deletion-CVE-2025-32819	Suspected Compromise
High	SysAid-On-Prem-Authenticated-Command-Injection-CVE-2025-2778	CVE-2025-2778	HTTP_CRL-SysAid-On-Prem-Authenticated-Command-Injection-CVE-2025-2778	Suspected Compromise

TLS Client Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	OpenSSL-Name-Check-Denial-Of-Service-CVE-2024-6119	CVE-2024-6119	TLS_CS-OpenSSL-Name-Check-Denial-Of-Service-CVE-2024-6119	Potential Compromise

Text File Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Webkit-fontLoadingTimerFired-Use-After-Free-CVE-2024-54502	CVE-2024-54502	File-Text_Webkit-fontLoadingTimerFired-Use-After-Free-CVE-2024-54502	Potential Compromise

Other Binary File Stream

Risk	Vulnerability/Situation	References	Related Fingerprint	Situation Type
High	Gnu-GIMP-DDS-Image-Parsing-Integer-Overflow-CVE-2025-2760	CVE-2025-2760	File-Binary_Gnu-GIMP-DDS-Image-Parsing-Integer-Overflow-CVE-2025-2760	Suspected Compromise

Updated detected attacks:

HTTP Client Stream

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Zend-Technologies-Zend-Framework-Zend_XmlRpc-Information-Disclosure

CVE-2012-3363

HTTP_CS-Xml-Dtd-External-Entity-Injection

Suspected Compromise

Name: HTTP_CS-Xml-Dtd-External-Entity-Multiple-Vulnerabilities->HTTP_CS-Xml-Dtd-External-Entity-Injection

Comment has changed

Description has changed

Fingerprint regexp changed

BOOTP Client Stream

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Red-Hat-Networkmanager-DHCP-Command-Injection

CVE-2018-1111

BOOTP_CS-Red-Hat-Networkmanager-DHCP-Command-Injection

Suspected Compromise

Fingerprint regexp changed

High

Microsoft-Windows-DHCP-Client-Dhcpextractfulloptions-Code-Execution

CVE-2019-0697

BOOTP_CS-Microsoft-Windows-DHCP-Client-Dhcpextractfulloptions-Code-Execution

Suspected Compromise

Detection mechanism updated

BOOTP Server Stream

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Microsoft-Windows-DHCP-Client-Dhcpextractfulloptions-Code-Execution

CVE-2019-0697

BOOTP_SS-Microsoft-Windows-DHCP-Client-Dhcpextractfulloptions-Code-Execution

Suspected Compromise

Detection mechanism updated

TCP Client Stream Unknown

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Rockwell-Automation-Rslinx-Classic-Buffer-Overflow-CVE-2018-14821

CVE-2018-14821

Generic_CS-Rockwell-Automation-Rslinx-Classic-Buffer-Overflow-CVE-2018-14821

Suspected Compromise

Name: Generic_CS-Rockwell-Automation-Rslinx-Classic-Cip-Sendrrdata-Heap-Buffer-Overflow->Generic_CS-Rockwell-Automation-Rslinx-Classic-Buffer-Overflow-CVE-2018-14821

Fingerprint regexp changed

High

Rockwell-Automation-Rslinx-Ethernet-IP-SendUnitData-DoS-CVE-2020-13573

CVE-2020-13573

Generic_CS-Rockwell-Automation-Rslinx-Ethernet-IP-SendUnitData-DoS-CVE-2020-13573

Suspected Compromise

Name: Generic_CS-Rockwell-Automation-Rslinx-Ethernet-IP-SendUnitData-DoS->Generic_CS-Rockwell-Automation-Rslinx-Ethernet-IP-SendUnitData-DoS-CVE-2020-13573

Comment has changed

Fingerprint regexp changed

HTTP Request URI

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Oracle-Iplanet-Web-Server-Information-Disclosure-Attack-CVE-2020-9315

CVE-2020-9315

HTTP_CSU-Oracle-Iplanet-Web-Server-Information-Disclosure-Attack-CVE-2020-9315

Potential Compromise

Name: HTTP_CSU-Oracle-Iplanet-Web-Server-Information-Disclosure-Attack->HTTP_CSU-Oracle-Iplanet-Web-Server-Information-Disclosure-Attack-CVE-2020-9315

Comment has changed

Fingerprint regexp changed

High

Common-Command-Injection-String

No CVE/CAN

HTTP_CSU-Common-Command-Injection-String-2

Potential Compromise

Fingerprint regexp changed

HTTP Normalized Request-Line

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Php-Unserialize-Call-Spl-Arrayobject-And-Splobjectstorage-Memory-Corruption

CVE-2014-3515

HTTP_CRL-Php-Unserialize-Call-Spl-Arrayobject-And-Splobjectstorage-Memory-Corruption

Suspected Compromise

Fingerprint regexp changed

High

Microsoft.NET-Iriparsing-Remote-Code-Execution-CVE-2014-4121

CVE-2014-4121

HTTP_CRL-Microsoft.NET-Iriparsing-Remote-Code-Execution-CVE-2014-4121

Suspected Compromise

Name: HTTP_CRL-Microsoft.NET-Iriparsing-Remote-Code-Execution->HTTP_CRL-Microsoft.NET-Iriparsing-Remote-Code-Execution-CVE-2014-4121

High

Php-Core-Unserialize-Key-Name-Use-After-Free

CVE-2015-0231

HTTP_CRL-Php-Core-Unserialize-Key-Name-Use-After-Free

Suspected Compromise

Fingerprint regexp changed

High

SkyBlueCanvas-CMS-Command-Execution-CVE-2014-1683

CVE-2014-1683

HTTP_CRL-SkyBlueCanvas-CMS-Command-Execution-CVE-2014-1683

Suspected Compromise

Name: HTTP_CRL_SkyBlueCanvas-CMS-Command-Execution->HTTP_CRL-SkyBlueCanvas-CMS-Command-Execution-CVE-2014-1683

Comment has changed

Fingerprint regexp changed

Text File Stream

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Apache-Jspwiki-Userpreferences-Cross-Site-Request-Forgery

CVE-2022-28731

File-Text_Apache-Jspwiki-Userpreferences-Cross-Site-Request-Forgery

Potential Compromise

Detection mechanism updated

Identified Text File Stream

Risk

Vulnerability/Situation

References

Related Fingerprint

Situation Type

Change Description

High

Springsource-Spring-Framework-XML-External-Entity-Information-Disclosure

CVE-2013-4152

File-TextId_Xml-Dtd-External-Entity-Injection

Suspected Compromise

Name: File-TextId_Xml-Dtd-External-Entity-Multiple-Vulnerabilities->File-TextId_Xml-Dtd-External-Entity-Injection

Comment has changed

Description has changed

Category tag group CVE2025 added

Fingerprint regexp changed

LIST OF OTHER CHANGES:

New objects:

Type	Name
Category	Fortinet FortiSandbox
Element Ref	Application dependency from Microsoft-Intune to Microsoft
Element Ref	Application dependency from Microsoft-Intune to Microsoft-Windows-Update
Element Ref	Application dependency from Microsoft-Intune to Skype

Updated objects:

Type

Name

Changes

Situation

HTTP_CS-Multipart-Filename-Potential-Directory-Traversal

Category tag situation Suspected Compromise added

Category tag situation Potential Compromise removed

Situation

HTTP_CRL-Suspicious-Parameter-Value

Fingerprint regexp changed

Situation

Generic_CS-Rockwell-Automation-Rslinx-Classic-Forward-Open-Electronic-Key-Stack-Buffer-Overflow

Description has changed

Attacker: connection_source->none

Victim: connection_destination->none

Category tag situation Obsolete added

Category tag os Any Operating System removed

Category tag hardware Any Hardware removed

Category tag application Rockwell Automation RSLinx Classic removed

Category tag group CVE2019 removed

Category tag os_not_specific Any Operating System not specific removed

Category tag situation Potential Compromise removed

Category tag group TCP Correlation Dependency Group removed

Category tag group Severity over 4 Correlation Dependency Group removed

Category tag group TCP Client Traffic removed

Application

TOR

Application

Microsoft-Intune

Category tag application_group Application Routing removed

Application detection context content changed

Application Port "tcp/443 tls: mandatory" -> "tcp/443 tls: free"

TLS Match identification changed from true to false

Application

NordVPN

Certificate Authority

DigiCert Baltimore CA-2 G2

Marked for removal

Certificate Authority

DigiCert Baltimore TLS RSA SHA256 2020 CA1

Marked for removal

Certificate Authority

DigiCert Global Root CA (1)

Marked for removal

Certificate Authority

DigiCert High Assurance EV Root CA (1)

Marked for removal

Certificate Authority

Trust Technologies Global CA

Marked for removal

Certificate Authority

TUBITAK Kamu SM SSL Sertifika Hizmet Saglayicisi - Surum 1

Marked for removal

Situation

File_Blocked-Bad-SHA1-Hash

Detection mechanism updated

IPList

TOR exit nodes IP Address List

IPList

Amazon AMAZON

IPList

Spotify

IPList

Amazon EC2

IPList

TOR relay nodes IP Address List

IPList

Okta IP Address List

IPList

Malicious Site IP Address List

IPList

NordVPN Servers IP Address List

IPList

Amazon AMAZON us-east-1

IPList

Amazon EC2 us-east-1

IPList

Forcepoint Drop IP Address List

HOW TO IMPORT AND ACTIVATE THE DYNAMIC UPDATE PACKAGE

Download the dynamic update package, then make sure that the checksums for the original files and the files that you have downloaded match.
In the Management Client, select Menu > File > Import > Import Update Packages.
Browse to the file, select it, then click Import.
Select Configuration, then browse to Administration > Other Elements > Updates.
Right-click the imported dynamic update package, then select Activate.
When the activation is finished, refresh the policy on all NGFW Engines. If your policy uses a custom template, you might need to edit the policy.

DISCLAIMER AND COPYRIGHT

Copyright © 2025 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.

All other trademarks used in this document are the property of their respective owners.

Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.