The Sophos Intrusion Prevention System shields the network from known attacks by matching the
network traffic against the signatures in the IPS Signature Database. These signatures are
developed to significantly increase detection performance and reduce the false alarms.
Applicable to: XGS-87, XGS-87(w), XGS-107, XGS-107(w),
XGS-116, XGS-116(w), XGS-126, XGS-126(w), XGS-136, XGS-136(w), XGS-2100, XGS-2300, XGS-3100,
XGS-3300, XGS-4300, XGS-4500, XG-86, XG-86(w), XG-106, XG-106(w), XG-115, XG-115(w), XG-125,
XG-125(w), XG-135, XG-135(w), XG-210, XG-230, XG-310, XG-330, XG-430, XG-450, SG-105, SG-105(w),
SG-115, SG-115(w), SG-125, SG-125(w), SG-135, SG-135(w), SG-210, SG-230, SG-310, SG-330, SG-430,
SG-450, SG-550, SG-650 and Any virtual deployment with RAM < 24GB
The table below provides details of Signatures included in this release.
This IPS Release includes Twenty three(23) Signatures
to address
Fifteen(15) Vulnerabilities.
Fixed issues, listed by ID, description, explanation and Workaround.
| Name |
CVE-ID |
Category |
Severity |
| BROWSER-WEBKIT Apple WebKit fontLoadingTimerFired use-after-free attempt |
CVE-2024-54502 |
browser-webkit |
2 |
| SERVER-WEBAPP Adobe ColdFusion DataSourceDef Security Feature CVE-2025-43560 Bypass Vulnerability |
CVE-2025-43560 |
server-webapp |
2 |
| SERVER-WEBAPP Avtech IP Camera CVE-2024-7029 Command Injection Attempt |
CVE-2024-7029 |
server-webapp |
1 |
| SERVER-WEBAPP DocsGPT Software CVE-2025-0868 Remote Code Execution Vulnerability |
CVE-2025-0868 |
server-webapp |
1 |
| SERVER-WEBAPP DrayTek Vigor Routers CVE-2024-12987 OS Command Injection Vulnerability |
CVE-2024-12987 |
server-webapp |
2 |
| SERVER-WEBAPP DrayTek Vigor routers OS command injection attempt |
CVE-2024-12987 |
server-webapp |
2 |
| SERVER-WEBAPP DrayTek Vigor routers OS CVE-2024-12987 Command Injection Vulnerability |
CVE-2024-12987 |
server-webapp |
2 |
| SERVER-WEBAPP Fortinet FortiSandbox Dashboard Widget Stored CVE-2024-27781 Cross-Site Scripting Attempt |
CVE-2024-27781 |
server-webapp |
1 |
| SERVER-WEBAPP Ivanti Endpoint Manager Credential Coercion Vulnerabilities |
CVE-2024-10811, CVE-2024-13159, CVE-2024-13160, CVE-2024-13161 |
server-webapp |
1 |
| SERVER-WEBAPP Ivanti Endpoint Manager Mobile Java Expression CVE-2025-4427 CVE-2025-4428 Language Injection Vulnerability |
CVE-2025-4427, CVE-2025-4428 |
server-webapp |
2 |
| SERVER-WEBAPP NodeBB API Access Token User Id CVE-2025-29513 Stored Cross-Site Scripting |
CVE-2025-29513 |
server-webapp |
3 |
| SERVER-WEBAPP Tenda W12 and i24 CVE-2025-3802 Stack Overflow Vulnerability |
CVE-2025-3802 |
server-webapp |
2 |
| SERVER-WEBAPP Zimbra Collaboration Suite remote code execution attempt |
CVE-2015-1197, CVE-2022-41352 |
server-webapp |
1 |
| SERVER-WEBAPP ZKTeco BioTime CVE-2023-38950 Directory Traversal Attempt |
CVE-2023-38950, CVE-2023-38952 |
server-webapp |
2 |
| SERVER-WEBAPP ZKTeco BioTime remote code execution attempt |
CVE-2023-38951 |
server-webapp |
1 |
The Sophos Intrusion Prevention System shields the network from known attacks by matching
the network traffic against the signatures in the IPS Signature Database. These
signatures are developed to significantly increase detection performance and reduce the
false alarms.
Applicable to: XG-550, XG-650, XG-750, XGS-5500,
XGS-6500 and Any virtual deployment with RAM >24GB
The table below provides details of Signatures included in this release.
This IPS Release includes Twenty six(26) Signatures
to address
Eighteen(18) Vulnerabilities.
Fixed issues, listed by ID, description, explanation and Workaround.
| Name |
CVE-ID |
Category |
Severity |
| BROWSER-WEBKIT Apple WebKit fontLoadingTimerFired use-after-free attempt |
CVE-2024-54502 |
browser-webkit |
2 |
| FILE-OTHER TRUFFLEHUNTER TALOS-2025-2190 attack attempt |
|
file-other |
1 |
| SERVER-WEBAPP Adobe ColdFusion DataSourceDef Security Feature CVE-2025-43560 Bypass Vulnerability |
CVE-2025-43560 |
server-webapp |
2 |
| SERVER-WEBAPP Avtech IP Camera CVE-2024-7029 Command Injection Attempt |
CVE-2024-7029 |
server-webapp |
1 |
| SERVER-WEBAPP DocsGPT Software CVE-2025-0868 Remote Code Execution Vulnerability |
CVE-2025-0868 |
server-webapp |
1 |
| SERVER-WEBAPP DrayTek Vigor Routers CVE-2024-12987 OS Command Injection Vulnerability |
CVE-2024-12987 |
server-webapp |
2 |
| SERVER-WEBAPP DrayTek Vigor routers OS command injection attempt |
CVE-2024-12987 |
server-webapp |
2 |
| SERVER-WEBAPP DrayTek Vigor routers OS CVE-2024-12987 Command Injection Vulnerability |
CVE-2024-12987 |
server-webapp |
2 |
| SERVER-WEBAPP Fortinet FortiSandbox Dashboard Widget Stored CVE-2024-27781 Cross-Site Scripting Attempt |
CVE-2024-27781 |
server-webapp |
1 |
| SERVER-WEBAPP Ivanti Endpoint Manager Credential Coercion Vulnerabilities |
CVE-2024-10811, CVE-2024-13159, CVE-2024-13160, CVE-2024-13161 |
server-webapp |
1 |
| SERVER-WEBAPP Ivanti Endpoint Manager Mobile Java Expression CVE-2025-4427 CVE-2025-4428 Language Injection Vulnerability |
CVE-2025-4427, CVE-2025-4428 |
server-webapp |
2 |
| SERVER-WEBAPP NodeBB API Access Token User Id CVE-2025-29513 Stored Cross-Site Scripting |
CVE-2025-29513 |
server-webapp |
3 |
| SERVER-WEBAPP Samsung MagicInfo directory traversal attempt |
CVE-2024-7399, CVE-2025-4632 |
server-webapp |
1 |
| SERVER-WEBAPP SonicWall SMA command injection attempt |
CVE-2023-44221 |
server-webapp |
2 |
| SERVER-WEBAPP Tenda W12 and i24 CVE-2025-3802 Stack Overflow Vulnerability |
CVE-2025-3802 |
server-webapp |
2 |
| SERVER-WEBAPP Zimbra Collaboration Suite remote code execution attempt |
CVE-2015-1197, CVE-2022-41352 |
server-webapp |
1 |
| SERVER-WEBAPP ZKTeco BioTime CVE-2023-38950 Directory Traversal Attempt |
CVE-2023-38950, CVE-2023-38952 |
server-webapp |
2 |
| SERVER-WEBAPP ZKTeco BioTime remote code execution attempt |
CVE-2023-38951 |
server-webapp |
1 |
Name: Name of the Signature.
CVE-ID: CVE Identification Number - Common
Vulnerabilities and Exposures (CVE) provides reference of CVE Identifiers for
publicly known information security vulnerabilities.
Category: Class type according to threat.
Severity: Degree of severity - The levels of
severity are described in the table below:
Fixed issues, listed by ID, description, explanation and
Workaround.
| Severity Level |
Severity Criteria |
| 1 |
Critical |
| 2 |
Major |
| 3 |
Moderate |
| 4 |
Minor |
| 5 |
Warning |
Important Notice
Sophos Technologies Pvt. Ltd. has supplied this Information believing it to be
accurate and reliable at the time of printing, but is presented without warranty
of any kind, expressed or implied. Users must take full responsibility for their
application of any products. Sophos Technologies Pvt. Ltd. assumes no
responsibility for any errors that may appear in this document. Sophos
Technologies Pvt. Ltd. reserves the right, without notice to make changes in
product design or specifications. Information is subject to change without
notice.
RESTRICTED RIGHTS
©1997 - 2025 Sophos Ltd. All rights reserved.
All rights reserved. Sophos, Sophos logo are trademark of Sophos Technologies
Pvt. Ltd.
Corporate Headquarters
Sophos Technologies Pvt. Ltd.
Registered in England and Wales No. 2096520,
The Pentagon, Abingdon Science Park,
Abingdon, OX14 3YP, UK
Web site: www.sophos.com