Release notes for update package 1910-5242

This update package improves the detection capabilities of the Forcepoint LLM system.

RELEASE DATE:     Thursday August 07, 2025
MD5 CHECKSUM:     623fdd7473089b902a8bce6ea6b4c591
SHA1 CHECKSUM:     be55513d39e036793a30b2e3ea71310106f59bea
SHA256 CHECKSUM:     e379299e34a7690d579985c2aaf90b8b77a256e5e2b3c18381f66280cf640c08


UPDATE CRITICALITY:    HIGH

List of detected attacks in this update package:

Risk level Description Reference Vulnerability
High     An attempt to exploit a vulnerability in Adobe Experience Manager detected     CVE-2025-54253     Adobe-Experience-Manager-Struts2-Devmode-RCE-CVE-2025-54253
High     An attempt to exploit a vulnerability in JetBrains TeamCity detected     CVE-2025-52877     JetBrains-TeamCity-DiskUsageBuildsStats-Reflected-XSS-CVE-2025-52877
High     An attempt to exploit a vulnerability in Adobe Experience Manager detected     CVE-2025-49533     Adobe-Experience-Manager-Formserver-Insecure-Deserialization-CVE-2025-49533
High     An attempt to exploit a vulnerability in Adobe Systems ColdFusion detected     CVE-2025-43566     Adobe-ColdFusion-Car-Archive-Directory-Traversal-CVE-2025-43566
High     An attempt to exploit a vulnerability in SonicWall SMA100 series detected     CVE-2025-40598     SonicWall-SMA100-RadiusChallengeLogin-Cross-Site-Scripting-CVE-2025-40598
High     An attempt to exploit a vulnerability in SonicWall SMA100 series detected     CVE-2025-40596     SonicWall-SMA100-Stack-Buffer-Overflow-CVE-2025-40596
High     An attempt to exploit a vulnerability in ZendTo detected     CVE-2025-34508     ZendTo-Zendto-Dropoff-Tmp_Name-Directory-Traversal-CVE-2025-34508
High     An attempt to exploit a vulnerability in ZendTo detected     CVE-2025-34508     ZendTo-Zendto-Dropoff-Tmp_Name-Directory-Traversal-CVE-2025-34508
High     An attempt to exploit a vulnerability in Yii Framework detected     CVE-2025-32432     Craft-CMS-Remote-Code-Execution-CVE-2025-32432
High     An attempt to exploit a vulnerability in Ivanti Endpoint Manager Mobile detected     CVE-2025-6771     Ivanti-Endpoint-Manager-Mobile-SSHConfigImpl-UploadPubKey-Command-Injection
High     An attempt to exploit a vulnerability in Ivanti Endpoint Manager Mobile detected     CVE-2025-4427     Ivanti-EPMM-API-V2-Authentication-Bypass-CVE-2025-4427
High     A possible attempt to exploit a vulnerability in Google Chrome detected     CVE-2024-7025     Google-Chrome-Layout-Integer-Overflow-CVE-2024-7025
High     An attempt to exploit a vulnerability in D-Link detected     CVE-2022-40799     D-Link-DNR-322L-Backup-Config-Command-Injection-CVE-2022-40799
High     An attempt to exploit a vulnerability in D-Link detected     CVE-2020-25079     D-Link-Authenticated-Command-Injection-CVE-2020-25079
High     An attempt to exploit a vulnerability in D-Link detected     CVE-2020-25078     D-Link-DCS-2530L-DCS-2670L-Password-Disclosure-CVE-2020-25078
High     An attempt to exploit a vulnerability in Ruby on Rails detected     CVE-2018-3760     Ruby-On-Rails-Sprockets-Double-Encoding-Path-Traversal-CVE-2018-3760

Jump to: Detected Attacks Other Changes

DETECTED ATTACKS

New detected attacks:

HTTP Client Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High ZendTo-Zendto-Dropoff-Tmp_Name-Directory-Traversal-CVE-2025-34508 CVE-2025-34508 HTTP_CS-ZendTo-Zendto-Dropoff-Tmp_ame-Directory-Traversal-CVE-2025-34508 Suspected Compromise
High Ivanti-EPMM-API-V2-Authentication-Bypass-CVE-2025-4427 CVE-2025-4427 HTTP_CS-Ivanti-EPMM-API-V2-Authentication-Bypass-CVE-2025-4427 Potential Compromise
High Ivanti-Endpoint-Manager-Mobile-SSHConfigImpl-UploadPubKey-Command-Injection CVE-2025-6771 HTTP_CS-Ivanti-Endpoint-Manager-Mobile-SSHConfigImpl-UploadPubKey-Command-Injection-CVE-2025-6771 Suspected Compromise

HTTP Request URI

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Ruby-On-Rails-Sprockets-Double-Encoding-Path-Traversal-CVE-2018-3760 CVE-2018-3760 HTTP_CSU-Ruby-On-Rails-Sprockets-Double-Encoding-Path-Traversal-CVE-2018-3760 Suspected Compromise
High SonicWall-SMA100-Stack-Buffer-Overflow-CVE-2025-40596 CVE-2025-40596 HTTP_CSU-SonicWall-SMA100-Stack-Buffer-Overflow-CVE-2025-40596 Suspected Denial of Service
High D-Link-Authenticated-Command-Injection-CVE-2020-25079 CVE-2020-25079 HTTP_CSU-D-Link-Authenticated-Command-Injection-CVE-2020-25079 Suspected Compromise
High Adobe-Experience-Manager-Formserver-Insecure-Deserialization-CVE-2025-49533 CVE-2025-49533 HTTP_CSU-Adobe-Experience-Manager-Formserver-Insecure-Deserialization-CVE-2025-49533 Suspected Compromise
High Adobe-Experience-Manager-Struts2-Devmode-RCE-CVE-2025-54253 CVE-2025-54253 HTTP_CSU-Adobe-Experience-Manager-Struts2-Devmode-RCE-CVE-2025-54253 Suspected Compromise

HTTP Normalized Request-Line

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Craft-CMS-Remote-Code-Execution-CVE-2025-32432 CVE-2025-32432 HTTP_CRL-Yii-Framework-Arbitrary-Class-Instantiation Suspected Compromise
High ZendTo-Zendto-Dropoff-Tmp_Name-Directory-Traversal-CVE-2025-34508 CVE-2025-34508 HTTP_CRL-Zendto-Dropoff-Tmp_Name-Directory-Traversal-CVE-2025-34508 Suspected Compromise
High JetBrains-TeamCity-DiskUsageBuildsStats-Reflected-XSS-CVE-2025-52877 CVE-2025-52877 HTTP_CRL-JetBrains-TeamCity-DiskUsageBuildsStats-Reflected-Cross-Site-Scripting-CVE-2025-52877 Suspected Compromise
High Adobe-ColdFusion-Car-Archive-Directory-Traversal-CVE-2025-43566 CVE-2025-43566 HTTP_CRL-Adobe-ColdFusion-Car-Archive-Directory-Traversal-CVE-2025-43566 Suspected Compromise
High SonicWall-SMA100-RadiusChallengeLogin-Cross-Site-Scripting-CVE-2025-40598 CVE-2025-40598 HTTP_CSU-SonicWall-SMA100-RadiusChallengeLogin-Cross-Site-Scripting-CVE-2025-40598 Suspected Compromise
High D-Link-DNR-322L-Backup-Config-Command-Injection-CVE-2022-40799 CVE-2022-40799 HTTP_CSU-D-Link-DNR-322L-Backup-Config-Command-Injection-CVE-2022-40799 Suspected Compromise

Text File Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High D-Link-DCS-2530L-DCS-2670L-Password-Disclosure-CVE-2020-25078 CVE-2020-25078 File-Text_D-Link-DCS-2530L-DCS-2670L-Password-Disclosure-CVE-2020-25078 Suspected Compromise
High Google-Chrome-Layout-Integer-Overflow-CVE-2024-7025 CVE-2024-7025 File-Text_Google-Chrome-Layout-Integer-Overflow-CVE-2024-7025 Suspected Compromise

Updated detected attacks:

HTTP Client Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High Pulse-Secure-VPN-Gzip-RCE-CVE-2020-8260 CVE-2020-8260 HTTP_CS-Pulse-Secure-VPN-Gzip-RCE-CVE-2020-8260 Potential Compromise
Name: HTTP_CS-Pulse-Secure-VPN-Gzip-RCE->HTTP_CS-Pulse-Secure-VPN-Gzip-RCE-CVE-2020-8260
Comment has changed
Fingerprint regexp changed

HTTP Request URI

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High D-Link-DCS-2530L-DCS-2670L-Password-Disclosure-CVE-2020-25078 CVE-2020-25078 HTTP_CSU-D-Link-DCS-2530L-DCS-2670L-Password-Disclosure-CVE-2020-25078 Potential Compromise
Fingerprint regexp changed

HTTP Request Header Line

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High HTTP-Apache-Portable-Runtime-Apr-Psprintf-Long-String-Vulnerability CVE-2003-0245 HTTP_CSH-Suspiciously-Long-Host-Header Attack Related Anomalies
Description has changed
Category tag group CVE2025 added
High Microsoft-Exchange-Information-Disclosure-CVE-2021-33766 CVE-2021-33766 HTTP_CSH-Microsoft-Exchange-Information-Disclosure-CVE-2021-33766 Potential Compromise
Name: HTTP_CSH-Microsoft-Exchange-Authentication-Bypass-CVE-2021-33766->HTTP_CSH-Microsoft-Exchange-Information-Disclosure-CVE-2021-33766
Description has changed
Attacker: connection_destination->connection_source
Victim: connection_source->connection_destination
Category tag situation Potential Compromise added
Category tag situation Suspected Compromise removed
Fingerprint regexp changed

HTTP Normalized Request-Line

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High D-Link-DNS-320-ShareCenter-Remote-Denial-Of-Service No CVE/CAN HTTP_CRL-D-Link-DNS-320-ShareCenter-Remote-Denial-Of-Service-2 Suspected Compromise
Fingerprint regexp changed
High Microsoft-SharePoint-Remote-Code-Execution-Vulnerability-CVE-2025-49704 CVE-2025-49704 HTTP_CRL-Microsoft-SharePoint-Remote-Code-Execution-CVE-2025-49704 Suspected Compromise
Detection mechanism updated

Text File Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High Information-Stealer-Using-Fake-Captcha No CVE/CAN File-Text_Information-Stealer-Using-Fake-Browser-Dialogs Potential Compromise
Fingerprint regexp changed

Identified Text File Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High Springsource-Spring-Framework-XML-External-Entity-Information-Disclosure CVE-2013-4152 File-TextId_Xml-Dtd-External-Entity-Injection Suspected Compromise
Description has changed
Category tag application Adobe Experience Manager added

LIST OF OTHER CHANGES:

New objects:

Type Name
Category ZendTo
Category Adobe Experience Manager
IPList Amazon IVS_LOW_LATENCY
IPList Amazon AURORA_DSQL eu-central-1
IPList Amazon EC2 sa-west-1
IPList Amazon AMAZON sa-west-1
IPList Oracle Cloud Infrastructure us-quincy-1
IPList Oracle Cloud Infrastructure us-desmoines-1
IPList Oracle Cloud Infrastructure eu-dublin-3
IPList Oracle Services Network us-quincy-1
IPList Oracle Services Network us-desmoines-1
IPList Oracle Services Network eu-dublin-3

Updated objects:

Type Name Changes
IPList Rwanda
IPList Somalia
IPList Yemen
IPList Iraq
IPList Saudi Arabia
IPList Iran
IPList Cyprus
IPList Tanzania
IPList Syria
IPList Armenia
IPList Kenya
IPList DR Congo
IPList Djibouti
IPList Uganda
IPList Central African Republic
IPList Seychelles
IPList Jordan
IPList Lebanon
IPList Kuwait
IPList Oman
IPList Qatar
IPList Bahrain
IPList United Arab Emirates
IPList Israel
IPList Türkiye
IPList Ethiopia
IPList Eritrea
IPList Egypt
IPList Sudan
IPList Greece
IPList Burundi
IPList Estonia
IPList Latvia
IPList Azerbaijan
IPList Lithuania
IPList Svalbard and Jan Mayen
IPList Georgia
IPList Moldova
IPList Belarus
IPList Finland
IPList Åland Islands
IPList Ukraine
IPList North Macedonia
IPList Hungary
IPList Bulgaria
IPList Albania
IPList Poland
IPList Romania
IPList Kosovo
IPList Zimbabwe
IPList Zambia
IPList Comoros
IPList Malawi
IPList Lesotho
IPList Botswana
IPList Mauritius
IPList Eswatini
IPList Réunion
IPList South Africa
IPList Mayotte
IPList Mozambique
IPList Madagascar
IPList Afghanistan
IPList Pakistan
IPList Bangladesh
IPList Turkmenistan
IPList Tajikistan
IPList Sri Lanka
IPList Bhutan
IPList India
IPList Maldives
IPList British Indian Ocean Territory
IPList Nepal
IPList Myanmar
IPList Uzbekistan
IPList Kazakhstan
IPList Kyrgyzstan
IPList French Southern Territories
IPList Heard and McDonald Islands
IPList Cocos (Keeling) Islands
IPList Palau
IPList Vietnam
IPList Thailand
IPList Indonesia
IPList Laos
IPList Taiwan
IPList Philippines
IPList Malaysia
IPList China
IPList Hong Kong
IPList Brunei
IPList Macao
IPList Cambodia
IPList South Korea
IPList Japan
IPList North Korea
IPList Singapore
IPList Cook Islands
IPList Timor-Leste
IPList Russia
IPList Mongolia
IPList Australia
IPList Christmas Island
IPList Marshall Islands
IPList Federated States of Micronesia
IPList Papua New Guinea
IPList Solomon Islands
IPList Tuvalu
IPList Nauru
IPList Vanuatu
IPList New Caledonia
IPList Norfolk Island
IPList New Zealand
IPList Fiji
IPList Libya
IPList Cameroon
IPList Senegal
IPList Congo Republic
IPList Portugal
IPList Liberia
IPList Ivory Coast
IPList Ghana
IPList Equatorial Guinea
IPList Nigeria
IPList Burkina Faso
IPList Togo
IPList Guinea-Bissau
IPList Mauritania
IPList Benin
IPList Gabon
IPList Sierra Leone
IPList São Tomé and Príncipe
IPList Gibraltar
IPList Gambia
IPList Guinea
IPList Chad
IPList Niger
IPList Mali
IPList Western Sahara
IPList Tunisia
IPList Spain
IPList Morocco
IPList Malta
IPList Algeria
IPList Faroe Islands
IPList Denmark
IPList Iceland
IPList United Kingdom
IPList Switzerland
IPList Sweden
IPList The Netherlands
IPList Austria
IPList Belgium
IPList Germany
IPList Luxembourg
IPList Ireland
IPList Monaco
IPList France
IPList Andorra
IPList Liechtenstein
IPList Jersey
IPList Isle of Man
IPList Guernsey
IPList Slovakia
IPList Czechia
IPList Norway
IPList Vatican City
IPList San Marino
IPList Italy
IPList Slovenia
IPList Montenegro
IPList Croatia
IPList Bosnia and Herzegovina
IPList Angola
IPList Namibia
IPList Saint Helena
IPList Bouvet Island
IPList Barbados
IPList Cabo Verde
IPList Guyana
IPList French Guiana
IPList Suriname
IPList Saint Pierre and Miquelon
IPList Greenland
IPList Paraguay
IPList Uruguay
IPList Brazil
IPList Falkland Islands
IPList South Georgia and the South Sandwich Islands
IPList Jamaica
IPList Dominican Republic
IPList Cuba
IPList Martinique
IPList Bahamas
IPList Bermuda
IPList Anguilla
IPList Trinidad and Tobago
IPList St Kitts and Nevis
IPList Dominica
IPList Antigua and Barbuda
IPList Saint Lucia
IPList Turks and Caicos Islands
IPList Aruba
IPList British Virgin Islands
IPList St Vincent and Grenadines
IPList Montserrat
IPList Saint Martin
IPList Saint Barthélemy
IPList Guadeloupe
IPList Grenada
IPList Cayman Islands
IPList Belize
IPList El Salvador
IPList Guatemala
IPList Honduras
IPList Nicaragua
IPList Costa Rica
IPList Venezuela
IPList Ecuador
IPList Colombia
IPList Panama
IPList Haiti
IPList Argentina
IPList Chile
IPList Bolivia
IPList Peru
IPList Mexico
IPList French Polynesia
IPList Pitcairn Islands
IPList Kiribati
IPList Tokelau
IPList Tonga
IPList Wallis and Futuna
IPList Samoa
IPList Niue
IPList Northern Mariana Islands
IPList Guam
IPList Puerto Rico
IPList U.S. Virgin Islands
IPList U.S. Outlying Islands
IPList American Samoa
IPList Canada
IPList United States
IPList Palestine
IPList Serbia
IPList Antarctica
IPList Sint Maarten
IPList Curaçao
IPList Bonaire, Sint Eustatius, and Saba
IPList South Sudan
IPList TOR exit nodes IP Address List
IPList Amazon AMAZON
IPList Amazon EC2
IPList TOR relay nodes IP Address List
IPList Amazon API_GATEWAY
IPList Botnet IP Address List
IPList Malicious Site IP Address List
IPList NordVPN Servers IP Address List
IPList Amazon EC2 cn-northwest-1
IPList Amazon AMAZON eu-central-1
IPList Amazon EC2 eu-central-1
IPList Amazon AMAZON us-east-1
IPList Amazon EC2 us-east-1
IPList Amazon AMAZON us-east-2
IPList Forcepoint Drop IP Address List
IPList Amazon AMAZON us-west-1
IPList Amazon EC2 us-west-1
IPList Amazon AMAZON us-west-2
IPList Amazon EC2 us-west-2
IPList WeChat IP Address List
IPList Amazon AURORA_DSQL
Situation HTTP_CSU-Shared-Variables
Situation HTTP_CRL-Shared-Variables
Situation HTTP_PSU-Shared-Variables
Fingerprint regexp changed
Application TOR
Application NordVPN

DISCLAIMER AND COPYRIGHT

Copyright © 2025 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.

All other trademarks used in this document are the property of their respective owners.

Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.