Views:
Thank you for subscribing to Digital Vaccine updates brought to you by Trend Micro™ TippingPoint DVLabs. New content is now available at the Threat Management Center (TMC).
 
System Requirements
The 3.2.0 DV is supported on devices running TOS 5.x and earlier.
The 4.0.0 DV is supported on devices running TOS 6.x or higher, as well as vTPS. Please note that vTPS does not currently support pre-disclosed ZDI filters.
 
The Digital Vaccine can be manually downloaded from the following URLs:

Table of Contents
--------------------------
  New Filters - 10
  Modified Filters (logic changes) - 5
  Modified Filters (metadata changes only) - 4
  Removed Filters - 0		 
  New Filters:

    46512: HTTP: Zoho ManageEngine ADAudit Plus exportObject SQL Injection Vulnerability
      - IPS Version: 3.9.5 and after.
      - TPS Version: 5.2.2 and after.
      - vTPS Version: 5.2.2 and after.
      - Category: Vulnerabilities
      - Severity: Critical
      - Description: This filter detects an attempt to exploit a SQL injection vulnerability in Zoho ManageEngine ADAudit Plus.
      - Deployments:
        - Deployment: Security-Optimized (Block / Notify)
      - References:
        - Common Vulnerabilities and Exposures: CVE-2025-36527 CVSS 7.7
      - Classification: Vulnerability - Input Validation (Command injection, XSS, SQL injection, etc)
      - Protocol: HTTP
      - Platform: Multi-Platform Server Application or Service
      - Release Date: October 14, 2025

    46514: HTTP JetBrains TeamCity uploadArchive Directory Traversal Vulnerability
      - IPS Version: 3.9.5 and after.
      - TPS Version: 5.2.2 and after.
      - vTPS Version: 5.2.2 and after.
      - Category: Vulnerabilities
      - Severity: High
      - Description: This filter detects an attempt to exploit a directory traversal vulnerability in JetBrains TeamCity.
      - Deployments:
        - Deployment: Security-Optimized (Block / Notify)
      - References:
        - Common Vulnerabilities and Exposures: CVE-2025-59456 CVSS 4.8
      - Classification: Vulnerability - Input Validation (Command injection, XSS, SQL injection, etc)
      - Protocol: HTTP
      - Platform: Multi-Platform Server Application or Service
      - Release Date: October 14, 2025

    46515: HTTP: Microsoft Configuration Manager Code Execution Vulnerability
      - IPS Version: 3.9.5 and after.
      - TPS Version: 5.2.2 and after.
      - vTPS Version: 5.2.2 and after.
      - Category: Vulnerabilities
      - Severity: Critical
      - Description: This filter detects an attempt to exploit a code execution vulnerability in Microsoft Configuration Manager.
      - Deployments:
        - Deployment: Default (Block / Notify)
        - Deployment: Evaluation (Permit / Notify)
      - References:
        - Common Vulnerabilities and Exposures: CVE-2025-47178
      - Classification: Vulnerability - Input Validation (Command injection, XSS, SQL injection, etc)
      - Protocol: HTTP
      - Platform: Multi-Platform Server Application or Service
      - Release Date: October 14, 2025

    46516: HTTP: RARLAB WinRAR RAR Archive Directory Traversal Vulnerability (ZDI-25-409)
      - IPS Version: 3.9.5 and after.
      - TPS Version: 5.2.2 and after.
      - vTPS Version: 5.2.2 and after.
      - Category: Vulnerabilities
      - Severity: Critical
      - Description: The filter detects an attempt to exploit a directory traversal vulnerability in RARLAB WinRAR.
      - Deployments:
        - Deployment: Security-Optimized (Block / Notify)
      - References:
        - Common Vulnerabilities and Exposures: CVE-2025-6218 CVSS 7.9
        - Zero Day Initiative: ZDI-25-409
      - Classification: Vulnerability - Other
      - Protocol: HTTP
      - Platform: Multi-Platform Client Application
      - Release Date: October 14, 2025

    46524: HTTP: JetBrains TeamCity checksTrigger DOM-based Cross-Site Scripting Vulnerability
      - IPS Version: 3.9.5 and after.
      - TPS Version: 5.2.2 and after.
      - vTPS Version: 5.2.2 and after.
      - Category: Vulnerabilities
      - Severity: Critical
      - Description: This filter detects an attempt to exploit a cross-site scripting vulnerability in JetBrains TeamCity.
      - Deployments:
        - Deployment: Security-Optimized (Block / Notify)
      - References:
        - Common Vulnerabilities and Exposures: CVE-2025-47851 CVSS 4.2
      - Classification: Vulnerability - Other
      - Protocol: Other Protocol
      - Platform: Other Server Application or Service
      - Release Date: October 14, 2025

    46525: ZDI-CAN-27353: Zero Day Initiative Vulnerability (Fuji Electric Monitouch V-SFT)
      - IPS Version: 3.9.5 and after.
      - TPS Version: 5.2.2 and after.
      - vTPS Version: Not available.
      - Requires: IPS N-Platform, NX-Platform, or TPS models.
      - Category: Exploits
      - Severity: Critical
      - Description: This filter provides protection against exploitation of a zero-day vulnerability affecting Fuji Electric Monitouch V-SFT.
      - Deployments:
        - Deployment: Security-Optimized (Block / Notify / Trace)
      - Classification: Vulnerability - Other
      - Protocol: Other Protocol
      - Platform: Other Server Application or Service
      - Release Date: October 14, 2025

    46526: ZDI-CAN-28179: Zero Day Initiative Vulnerability (Autodesk AutoCAD)
      - IPS Version: 3.9.5 and after.
      - TPS Version: 5.2.2 and after.
      - vTPS Version: Not available.
      - Requires: IPS N-Platform, NX-Platform, or TPS models.
      - Category: Exploits
      - Severity: Critical
      - Description: This filter protects against the exploitation of a zero-day vulnerability affecting Autodesk AutoCAD.
      - Deployments:
        - Deployment: Security-Optimized (Block / Notify / Trace)
      - Classification: Vulnerability - Other
      - Protocol: Other Protocol
      - Platform: Other Server Application or Service
      - Release Date: October 14, 2025

    46527: HTTP: Cisco Secure Firewall ASA and FTD Authentication Bypass Vulnerability
      - IPS Version: 3.9.5 and after.
      - TPS Version: 5.2.2 and after.
      - vTPS Version: 5.2.2 and after.
      - Category: Vulnerabilities
      - Severity: High
      - Description: This filter detects an attempt to exploit an authentication bypass vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD).
      - Deployments:
        - Deployment: Default (Block / Notify)
        - Deployment: Evaluation (Permit / Notify)
      - References:
        - Common Vulnerabilities and Exposures: CVE-2025-20362
      - Classification: Vulnerability - Input Validation (Command injection, XSS, SQL injection, etc)
      - Protocol: HTTP
      - Platform: Multi-Platform Server Application or Service
      - Release Date: October 14, 2025

    46528: HTTP: Cisco Secure Firewall ASA and FTD Buffer Overflow Vulnerability
      - IPS Version: 3.9.5 and after.
      - TPS Version: 5.2.2 and after.
      - vTPS Version: 5.2.2 and after.
      - Category: Vulnerabilities
      - Severity: Critical
      - Description: This filter detects an attempt to exploit a buffer overflow vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD).
      - Deployments:
        - Deployment: Default (Block / Notify)
        - Deployment: Evaluation (Permit / Notify)
      - References:
        - Common Vulnerabilities and Exposures: CVE-2025-20333
      - Classification: Vulnerability - Input Validation (Command injection, XSS, SQL injection, etc)
      - Protocol: HTTP
      - Platform: Multi-Platform Server Application or Service
      - Release Date: October 14, 2025

    46531: HTTP: Microsoft Windows Server Update Service Insecure Deserialization Vulnerability
      - IPS Version: 3.9.5 and after.
      - TPS Version: 5.2.2 and after.
      - vTPS Version: 5.2.2 and after.
      - Category: Vulnerabilities
      - Severity: Critical
      - Description: This filter detects an attempt to exploit an insecure deserialization vulnerability in Microsoft Windows Server Update Service (WSUS).
      - Deployments:
        - Deployment: Default (Block / Notify)
        - Deployment: Evaluation (Permit / Notify)
      - References:
        - Common Vulnerabilities and Exposures: CVE-2025-59287
      - Classification: Vulnerability - Other
      - Protocol: HTTP
      - Platform: Multi-Platform Server Application or Service
      - Release Date: October 14, 2025
   


  Modified Filters (logic changes):
    * = Enabled in Default deployments

    13608: TCP: PDF Containing FlateDecode Filter
      - IPS Version: 3.2.2 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Description updated.
      - Detection logic updated.
      - Release Date: February 25, 2014
      - Last Modified Date: October 14, 2025

    16308: TCP: OpenSSH Connection Attempt
      - IPS Version: 3.6.2 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.
      - Release Date: July 08, 2014
      - Last Modified Date: October 14, 2025

    19729: HTTP: PHP libzip Integer Overflow Denial-of-Service Vulnerability
      - IPS Version: 3.1.3 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Detection logic updated.
      - Release Date: April 28, 2015
      - Last Modified Date: October 14, 2025

    35498: TCP: YSoSerial.Net Deserialization Tool Usage
      - IPS Version: 3.6.2 and after.
      - TPS Version: 4.0.0 and after.
      - vTPS Version: 4.0.1 and after.
      - Detection logic updated.
      - Vulnerability references updated.
      - Release Date: June 18, 2019
      - Last Modified Date: October 14, 2025

    45156: HTTP: Viessmann Vitogate 300 BN/MB vitogate.cgi form-0-2 Command Injection Vulnerability(ZDI-25-925)
      - IPS Version: 3.9.5 and after.
      - TPS Version: 5.2.2 and after.
      - vTPS Version: 5.2.2 and after.
      - Name changed from "45156: ZDI-CAN-23861: Zero Day Initiative Vulnerability (Viessmann Vitogate 300)".
      - Description updated.
      - Detection logic updated.
      - Vulnerability references updated.
      - Release Date: December 10, 2024
      - Last Modified Date: October 14, 2025



  Modified Filters (metadata changes only):
    * = Enabled in Default deployments

    * 45972: HTTP: Delta Electronics DIALink Directory Traversal Authentication Bypass Vulnerability (ZDI-25-927)
      - IPS Version: 3.9.5 and after.
      - TPS Version: 5.2.2 and after.
      - vTPS Version: 5.2.2 and after.
      - Name changed from "45972: ZDI-CAN-26843: Zero Day Initiative Vulnerability (Delta Electronics DIALink)".
      - Description updated.
      - Vulnerability references updated.
      - Release Date: June 10, 2025
      - Last Modified Date: October 14, 2025

    * 46070: HTTP: TBK DVR Command Injection Vulnerability
      - IPS Version: 3.9.5 and after.
      - TPS Version: 5.2.2 and after.
      - vTPS Version: 5.2.2 and after.
      - Miscellaneous modification.
      - Release Date: June 24, 2025
      - Last Modified Date: October 14, 2025

    46298: HTTP: RARLAB WinRAR ZIP Directory Traversal Vulnerability (ZDI-25-409)
      - IPS Version: 3.9.5 and after.
      - TPS Version: 5.2.2 and after.
      - vTPS Version: 5.2.2 and after.
      - Description updated.
      - Vulnerability references updated.
      - Release Date: August 19, 2025
      - Last Modified Date: October 14, 2025

    * 46346: HTTP: win-cli-mcp-server resolveCommandPath Command Injection Vulnerability (ZDI-25-930)
      - IPS Version: 3.9.5 and after.
      - TPS Version: 5.2.2 and after.
      - vTPS Version: 5.2.2 and after.
      - Name changed from "46346: ZDI-CAN-27787: Zero Day Initiative Vulnerability (Windows CLI MCP Server)".
      - Description updated.
      - Vulnerability references updated.
      - Release Date: August 26, 2025
      - Last Modified Date: October 14, 2025


  Removed Filters: None
Keywords: TippingPoint, Digital Vaccine, Trend Micro, DVLabs, Threat Management Center, TOS 5.x, TOS 6.x, vTPS, security filters, cybersecurity updates, malware protection, network security, new filters, modified filters, threat intelligence