Release notes for update package 1877-5242

This update package improves the detection capabilities of the Forcepoint LLM system.

RELEASE DATE:     Monday May 12, 2025
MD5 CHECKSUM:     b12a190b09212083fe7b81ae613a4d40
SHA1 CHECKSUM:     67ad149405e7aaffb26434b82ce107ddecdea69a
SHA256 CHECKSUM:     e66216cc037cb680d0401a7e65df4634b11345b944047d9f0445025fa0fabff7


UPDATE CRITICALITY:    HIGH

List of detected attacks in this update package:

Risk level Description Reference Vulnerability
High     An attempt to exploit a vulnerability in Sonicwall SMA100 series appliances detected     CVE-2025-32819     SonicWall-SMA100-Arbitrary-File-Deletion-CVE-2025-32819
High     An attempt to exploit a vulnerability in Apache Camel detected     CVE-2025-27636     Apache-Camel-Filter-Bypass-CVE-2025-27636
High     An attempt to exploit a vulnerability in SysAid detected     CVE-2025-2778     SysAid-On-Prem-Authenticated-Command-Injection-CVE-2025-2778
High     An attempt to exploit a vulnerability in The GIMP     CVE-2025-2760     Gnu-GIMP-DDS-Image-Parsing-Integer-Overflow-CVE-2025-2760
High     An attempt to exploit a vulnerability in Webkit detected     CVE-2024-54502     Webkit-fontLoadingTimerFired-Use-After-Free-CVE-2024-54502
High     An attempt to exploit a vulnerability in Fortinet FortiSandbox     CVE-2024-52961     Fortinet-FortiSandbox-VM-Download-Command-Injection-CVE-2024-52961
High     An attempt to exploit a vulnerability in OpenSSL detected     CVE-2024-6119     OpenSSL-Name-Check-Denial-Of-Service-CVE-2024-6119
High     An attempt to exploit a vulnerability in a TP-Link device     CVE-2020-9374     TP-Link-Traceroute-Remote-Code-Execution-CVE-2020-9374
High     An attempt to exploit a vulnerability in Rockwell Automation RSLinx Classic detected     CVE-2019-6553     Rockwell-Automation-Rslinx-Classic-Forward-Open-Electronic-Key-Stack-BOF
High     An attempt to exploit a vulnerability in Apache     CVE-2018-11759     Apache-Mod_jk-Access-Control-Bypass-CVE-2018-11759
High     An attempt to exploit a vulnerability in Red Hat RPM resource detected     CVE-2018-1111     Red-Hat-Networkmanager-DHCP-Command-Injection

Jump to: Detected Attacks Other Changes

DETECTED ATTACKS

New detected attacks:

BOOTP Server Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Red-Hat-Networkmanager-DHCP-Command-Injection CVE-2018-1111 BOOTP_SS-Red-Hat-Networkmanager-DHCP-Command-Injection Suspected Compromise

TCP Client Stream Unknown

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Rockwell-Automation-Rslinx-Classic-Forward-Open-Electronic-Key-Stack-BOF CVE-2019-6553 Generic_CS-Rockwell-Automation-Rslinx-Classic-Buffer-Overflow-CVE-2018-14829 Suspected Compromise

HTTP Request URI

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Apache-Mod_jk-Access-Control-Bypass-CVE-2018-11759 CVE-2018-11759 HTTP_CSU-Apache-Mod_jk-Access-Control-Bypass-CVE-2018-11759 Suspected Compromise

HTTP Normalized Request-Line

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Apache-Camel-Filter-Bypass-CVE-2025-27636 CVE-2025-27636 HTTP_CRL-Apache-Camel-Filter-Bypass-CVE-2025-27636 Suspected Compromise
High Fortinet-FortiSandbox-VM-Download-Command-Injection-CVE-2024-52961 CVE-2024-52961 HTTP_CRL-Fortinet-FortiSandbox-VM-Download-Command-Injection-CVE-2024-52961 Suspected Compromise
High TP-Link-Traceroute-Remote-Code-Execution-CVE-2020-9374 CVE-2020-9374 HTTP_CRL-TP-Link-Traceroute-Remote-Code-Execution-CVE-2020-9374 Suspected Compromise
High SonicWall-SMA100-Arbitrary-File-Deletion-CVE-2025-32819 CVE-2025-32819 HTTP_CRL-SonicWall-SMA100-Arbitrary-File-Deletion-CVE-2025-32819 Suspected Compromise
High SysAid-On-Prem-Authenticated-Command-Injection-CVE-2025-2778 CVE-2025-2778 HTTP_CRL-SysAid-On-Prem-Authenticated-Command-Injection-CVE-2025-2778 Suspected Compromise

TLS Client Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High OpenSSL-Name-Check-Denial-Of-Service-CVE-2024-6119 CVE-2024-6119 TLS_CS-OpenSSL-Name-Check-Denial-Of-Service-CVE-2024-6119 Potential Compromise

Text File Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Webkit-fontLoadingTimerFired-Use-After-Free-CVE-2024-54502 CVE-2024-54502 File-Text_Webkit-fontLoadingTimerFired-Use-After-Free-CVE-2024-54502 Potential Compromise

Other Binary File Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Gnu-GIMP-DDS-Image-Parsing-Integer-Overflow-CVE-2025-2760 CVE-2025-2760 File-Binary_Gnu-GIMP-DDS-Image-Parsing-Integer-Overflow-CVE-2025-2760 Suspected Compromise

Updated detected attacks:

HTTP Client Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High Zend-Technologies-Zend-Framework-Zend_XmlRpc-Information-Disclosure CVE-2012-3363 HTTP_CS-Xml-Dtd-External-Entity-Injection Suspected Compromise
Name: HTTP_CS-Xml-Dtd-External-Entity-Multiple-Vulnerabilities->HTTP_CS-Xml-Dtd-External-Entity-Injection
Comment has changed
Description has changed
Fingerprint regexp changed

BOOTP Client Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High Red-Hat-Networkmanager-DHCP-Command-Injection CVE-2018-1111 BOOTP_CS-Red-Hat-Networkmanager-DHCP-Command-Injection Suspected Compromise
Fingerprint regexp changed
High Microsoft-Windows-DHCP-Client-Dhcpextractfulloptions-Code-Execution CVE-2019-0697 BOOTP_CS-Microsoft-Windows-DHCP-Client-Dhcpextractfulloptions-Code-Execution Suspected Compromise
Detection mechanism updated

BOOTP Server Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High Microsoft-Windows-DHCP-Client-Dhcpextractfulloptions-Code-Execution CVE-2019-0697 BOOTP_SS-Microsoft-Windows-DHCP-Client-Dhcpextractfulloptions-Code-Execution Suspected Compromise
Detection mechanism updated

TCP Client Stream Unknown

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High Rockwell-Automation-Rslinx-Classic-Buffer-Overflow-CVE-2018-14821 CVE-2018-14821 Generic_CS-Rockwell-Automation-Rslinx-Classic-Buffer-Overflow-CVE-2018-14821 Suspected Compromise
Name: Generic_CS-Rockwell-Automation-Rslinx-Classic-Cip-Sendrrdata-Heap-Buffer-Overflow->Generic_CS-Rockwell-Automation-Rslinx-Classic-Buffer-Overflow-CVE-2018-14821
Fingerprint regexp changed
High Rockwell-Automation-Rslinx-Ethernet-IP-SendUnitData-DoS-CVE-2020-13573 CVE-2020-13573 Generic_CS-Rockwell-Automation-Rslinx-Ethernet-IP-SendUnitData-DoS-CVE-2020-13573 Suspected Compromise
Name: Generic_CS-Rockwell-Automation-Rslinx-Ethernet-IP-SendUnitData-DoS->Generic_CS-Rockwell-Automation-Rslinx-Ethernet-IP-SendUnitData-DoS-CVE-2020-13573
Comment has changed
Fingerprint regexp changed

HTTP Request URI

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High Oracle-Iplanet-Web-Server-Information-Disclosure-Attack-CVE-2020-9315 CVE-2020-9315 HTTP_CSU-Oracle-Iplanet-Web-Server-Information-Disclosure-Attack-CVE-2020-9315 Potential Compromise
Name: HTTP_CSU-Oracle-Iplanet-Web-Server-Information-Disclosure-Attack->HTTP_CSU-Oracle-Iplanet-Web-Server-Information-Disclosure-Attack-CVE-2020-9315
Comment has changed
Fingerprint regexp changed
High Common-Command-Injection-String No CVE/CAN HTTP_CSU-Common-Command-Injection-String-2 Potential Compromise
Fingerprint regexp changed

HTTP Normalized Request-Line

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High Php-Unserialize-Call-Spl-Arrayobject-And-Splobjectstorage-Memory-Corruption CVE-2014-3515 HTTP_CRL-Php-Unserialize-Call-Spl-Arrayobject-And-Splobjectstorage-Memory-Corruption Suspected Compromise
Fingerprint regexp changed
High Microsoft.NET-Iriparsing-Remote-Code-Execution-CVE-2014-4121 CVE-2014-4121 HTTP_CRL-Microsoft.NET-Iriparsing-Remote-Code-Execution-CVE-2014-4121 Suspected Compromise
Name: HTTP_CRL-Microsoft.NET-Iriparsing-Remote-Code-Execution->HTTP_CRL-Microsoft.NET-Iriparsing-Remote-Code-Execution-CVE-2014-4121
High Php-Core-Unserialize-Key-Name-Use-After-Free CVE-2015-0231 HTTP_CRL-Php-Core-Unserialize-Key-Name-Use-After-Free Suspected Compromise
Fingerprint regexp changed
High SkyBlueCanvas-CMS-Command-Execution-CVE-2014-1683 CVE-2014-1683 HTTP_CRL-SkyBlueCanvas-CMS-Command-Execution-CVE-2014-1683 Suspected Compromise
Name: HTTP_CRL_SkyBlueCanvas-CMS-Command-Execution->HTTP_CRL-SkyBlueCanvas-CMS-Command-Execution-CVE-2014-1683
Comment has changed
Fingerprint regexp changed

Text File Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High Apache-Jspwiki-Userpreferences-Cross-Site-Request-Forgery CVE-2022-28731 File-Text_Apache-Jspwiki-Userpreferences-Cross-Site-Request-Forgery Potential Compromise
Detection mechanism updated

Identified Text File Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High Springsource-Spring-Framework-XML-External-Entity-Information-Disclosure CVE-2013-4152 File-TextId_Xml-Dtd-External-Entity-Injection Suspected Compromise
Name: File-TextId_Xml-Dtd-External-Entity-Multiple-Vulnerabilities->File-TextId_Xml-Dtd-External-Entity-Injection
Comment has changed
Description has changed
Category tag group CVE2025 added
Fingerprint regexp changed

LIST OF OTHER CHANGES:

New objects:

Type Name
Category Fortinet FortiSandbox
Element Ref Application dependency from Microsoft-Intune to Microsoft
Element Ref Application dependency from Microsoft-Intune to Microsoft-Windows-Update
Element Ref Application dependency from Microsoft-Intune to Skype

Updated objects:

Type Name Changes
Situation HTTP_CS-Multipart-Filename-Potential-Directory-Traversal
Category tag situation Suspected Compromise added
Category tag situation Potential Compromise removed
Situation HTTP_CRL-Suspicious-Parameter-Value
Fingerprint regexp changed
Situation Generic_CS-Rockwell-Automation-Rslinx-Classic-Forward-Open-Electronic-Key-Stack-Buffer-Overflow
Description has changed
Attacker: connection_source->none
Victim: connection_destination->none
Category tag situation Obsolete added
Category tag os Any Operating System removed
Category tag hardware Any Hardware removed
Category tag application Rockwell Automation RSLinx Classic removed
Category tag group CVE2019 removed
Category tag os_not_specific Any Operating System not specific removed
Category tag situation Potential Compromise removed
Category tag group TCP Correlation Dependency Group removed
Category tag group Severity over 4 Correlation Dependency Group removed
Category tag group TCP Client Traffic removed
Application TOR
Application Microsoft-Intune
Category tag application_group Application Routing removed
Application detection context content changed
Application Port "tcp/443 tls: mandatory" -> "tcp/443 tls: free"
TLS Match identification changed from true to false
Application NordVPN
Certificate Authority DigiCert Baltimore CA-2 G2
Marked for removal
Certificate Authority DigiCert Baltimore TLS RSA SHA256 2020 CA1
Marked for removal
Certificate Authority DigiCert Global Root CA (1)
Marked for removal
Certificate Authority DigiCert High Assurance EV Root CA (1)
Marked for removal
Certificate Authority Trust Technologies Global CA
Marked for removal
Certificate Authority TUBITAK Kamu SM SSL Sertifika Hizmet Saglayicisi - Surum 1
Marked for removal
Situation File_Blocked-Bad-SHA1-Hash
Detection mechanism updated
IPList TOR exit nodes IP Address List
IPList Amazon AMAZON
IPList Spotify
IPList Amazon EC2
IPList TOR relay nodes IP Address List
IPList Okta IP Address List
IPList Malicious Site IP Address List
IPList NordVPN Servers IP Address List
IPList Amazon AMAZON us-east-1
IPList Amazon EC2 us-east-1
IPList Forcepoint Drop IP Address List

DISCLAIMER AND COPYRIGHT

Copyright © 2025 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.

All other trademarks used in this document are the property of their respective owners.

Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.