The Sophos Intrusion Prevention System shields the network from known attacks by matching the
network traffic against the signatures in the IPS Signature Database. These signatures are
developed to significantly increase detection performance and reduce the false alarms.
Applicable to: XGS-87, XGS-87(w), XGS-107, XGS-107(w),
XGS-116, XGS-116(w), XGS-126, XGS-126(w), XGS-136, XGS-136(w), XGS-2100, XGS-2300, XGS-3100,
XGS-3300, XGS-4300, XGS-4500, XG-86, XG-86(w), XG-106, XG-106(w), XG-115, XG-115(w), XG-125,
XG-125(w), XG-135, XG-135(w), XG-210, XG-230, XG-310, XG-330, XG-430, XG-450, SG-105, SG-105(w),
SG-115, SG-115(w), SG-125, SG-125(w), SG-135, SG-135(w), SG-210, SG-230, SG-310, SG-330, SG-430,
SG-450, SG-550, SG-650 and Any virtual deployment with RAM < 24GB
The table below provides details of Signatures included in this release.
This IPS Release includes Eleven(11) Signatures
to address
Eight(8) Vulnerabilities.
Fixed issues, listed by ID, description, explanation and Workaround.
| Name |
CVE-ID |
Category |
Severity |
| SERVER-APACHE Apache Parquet Avro CVE-2025-30065 Insecure Deserialization Vulnerability |
CVE-2025-30065 |
server-apache |
1 |
| SERVER-APACHE Apache ShardingSphere dataSourceConfiguration CVE-2020-1947 Deserialization Attempt Vulnerability |
CVE-2020-1947 |
server-apache |
3 |
| SERVER-OTHER Ollama ggufPadding CVE-2025-0317 Denial of Service Vulnerability |
CVE-2025-0317 |
server-other |
5 |
| SERVER-WEBAPP Apache Kafka CVE-2025-27817 Arbitrary File Read and SSRF Vulnerability |
CVE-2025-27817 |
server-webapp |
3 |
| SERVER-WEBAPP ASUS multiple routers command injection attempt |
CVE-2023-39780 |
server-webapp |
1 |
| SERVER-WEBAPP Graphana CVE-2025-4123 SSRF Vulnerability |
CVE-2025-4123 |
server-webapp |
1 |
| SERVER-WEBAPP IBM WebSphere Application Server WASPostParam Cookie CVE-2016-5983 Denial Of Service Attempt |
CVE-2016-5983 |
server-webapp |
1 |
| SERVER-WEBAPP Yiiframework Yii 2 Arbitrary CVE-2024-58136 Behavior Injection Attempt |
CVE-2024-4990, CVE-2024-58136, CVE-2025-32432 |
server-webapp |
1 |
The Sophos Intrusion Prevention System shields the network from known attacks by matching
the network traffic against the signatures in the IPS Signature Database. These
signatures are developed to significantly increase detection performance and reduce the
false alarms.
Applicable to: XG-550, XG-650, XG-750, XGS-5500,
XGS-6500 and Any virtual deployment with RAM >24GB
The table below provides details of Signatures included in this release.
This IPS Release includes Thirty two(32) Signatures
to address
Twenty two(22) Vulnerabilities.
Fixed issues, listed by ID, description, explanation and Workaround.
| Name |
CVE-ID |
Category |
Severity |
| FILE-OTHER Apple macOS CoreAudio mRemappingArray CVE-2025-31200 Memory Corruption Vulnerability |
CVE-2025-31200 |
file-other |
2 |
| MALWARE-CNC Win.InfoStealer.Stealc variant outbound connection attempt |
|
malware-cnc |
1 |
| MALWARE-CNC Win.InfoStealer.Vidar variant outbound connection attempt |
|
malware-cnc |
1 |
| MALWARE-CNC Win.Trojan.BPFDoor variant inbound connection attempt |
|
malware-cnc |
1 |
| OS-OTHER Apple multiple products memory corruption attempt |
CVE-2020-3837, CVE-2021-30900 |
os-other |
1 |
| OS-OTHER Cisco Nexus OS software command injection attempt |
CVE-2011-2569 |
os-other |
1 |
| OS-OTHER Intel x64 side-channel analysis information leak attempt |
CVE-2017-5715, CVE-2017-5753, CVE-2017-5754 |
os-other |
1 |
| OS-OTHER TRUFFLEHUNTER TALOS-2021-1262 attack attempt |
|
os-other |
1 |
| OS-OTHER TRUFFLEHUNTER TALOS-2021-1309 attack attempt |
|
os-other |
1 |
| OS-OTHER TRUFFLEHUNTER TALOS-2024-2006 attack attempt |
|
os-other |
1 |
| OS-OTHER TRUFFLEHUNTER TALOS-2024-2065 attack attempt |
|
os-other |
1 |
| OS-OTHER TRUFFLEHUNTER TALOS-2024-2081 attack attempt |
|
os-other |
1 |
| SERVER-APACHE Apache Parquet Avro CVE-2025-30065 Insecure Deserialization Vulnerability |
CVE-2025-30065 |
server-apache |
1 |
| SERVER-APACHE Apache ShardingSphere dataSourceConfiguration CVE-2020-1947 Deserialization Attempt Vulnerability |
CVE-2020-1947 |
server-apache |
3 |
| SERVER-OTHER BentoML runner server CVE-2025-32375 Remote Code Execution Vulnerability |
CVE-2025-31200 |
server-other |
1 |
| SERVER-OTHER Coder code-server proxy CVE-2025-47269 Unintended Proxy Vulnerability |
CVE-2025-47269 |
server-other |
2 |
| SERVER-OTHER Ollama ggufPadding CVE-2025-0317 Denial of Service Vulnerability |
CVE-2025-0317 |
server-other |
5 |
| SERVER-WEBAPP Apache Kafka CVE-2025-27817 Arbitrary File Read and SSRF Vulnerability |
CVE-2025-27817 |
server-webapp |
3 |
| SERVER-WEBAPP ASUS multiple routers command injection attempt |
CVE-2023-39780 |
server-webapp |
1 |
| SERVER-WEBAPP Graphana CVE-2025-4123 SSRF Vulnerability |
CVE-2025-4123 |
server-webapp |
1 |
| SERVER-WEBAPP IBM WebSphere Application Server WASPostParam Cookie CVE-2016-5983 Denial Of Service Attempt |
CVE-2016-5983 |
server-webapp |
1 |
| SERVER-WEBAPP Yiiframework Yii 2 Arbitrary CVE-2024-58136 Behavior Injection Attempt |
CVE-2024-4990, CVE-2024-58136, CVE-2025-32432 |
server-webapp |
1 |
Name: Name of the Signature.
CVE-ID: CVE Identification Number - Common
Vulnerabilities and Exposures (CVE) provides reference of CVE Identifiers for
publicly known information security vulnerabilities.
Category: Class type according to threat.
Severity: Degree of severity - The levels of
severity are described in the table below:
Fixed issues, listed by ID, description, explanation and
Workaround.
| Severity Level |
Severity Criteria |
| 1 |
Critical |
| 2 |
Major |
| 3 |
Moderate |
| 4 |
Minor |
| 5 |
Warning |
Important Notice
Sophos Technologies Pvt. Ltd. has supplied this Information believing it to be
accurate and reliable at the time of printing, but is presented without warranty
of any kind, expressed or implied. Users must take full responsibility for their
application of any products. Sophos Technologies Pvt. Ltd. assumes no
responsibility for any errors that may appear in this document. Sophos
Technologies Pvt. Ltd. reserves the right, without notice to make changes in
product design or specifications. Information is subject to change without
notice.
RESTRICTED RIGHTS
©1997 - 2025 Sophos Ltd. All rights reserved.
All rights reserved. Sophos, Sophos logo are trademark of Sophos Technologies
Pvt. Ltd.
Corporate Headquarters
Sophos Technologies Pvt. Ltd.
Registered in England and Wales No. 2096520,
The Pentagon, Abingdon Science Park,
Abingdon, OX14 3YP, UK
Web site: www.sophos.com