What is Axios?

Axios is a JavaScript library intended to ease interaction with internet HTTP services. It is used by some organizations to simplify their codebase compared to using standard browser functionality.

What is the vulnerability?

Prior to version 1.15.0, the Axios library is vulnerable to a specific “Gadget” attack chain that allows Prototype Pollution in any third-party dependency to be escalated into Remote Code Execution (RCE) or Full Cloud Compromise (via AWS IMDSv2 bypass).

Ref: https://nvd.nist.gov/vuln/detail/CVE-2026-40175

Has the vulnerability been fixed?

This vulnerability has been fixed in 1.15.0.

What are WithSecure’s recommendations for partners and customers?

We recommend partners and customers who use Axios act immediately to ensure their systems are not vulnerable.

WithSecure Exposure Management can detect and notify partners and customers that they have a vulnerable version.

Detection for vulnerable versions is available in unauthenticated scanning, and we are investigating the possibility to detect them on hosts via authenticated scans

What is the status of WithSecure systems in relation to this vulnerability?

WithSecure has thoroughly checked its own systems, and has confirmed that all services using Axios are using the latest version which is not vulnerable.

Are any WithSecure products affected?

WithSecure Policy Manager does contain a vulnerable version of the Axios library, and we have created a hotfix for this issue. We advise all our Business Suite partners and customers to apply this hotfix at the earliest opportunity.

The risk can further be mitigated by ensuring that Policy Manager’s Web Reporting interface is not accessible from the internet. This can be done with external firewall configurations.

The hotfix can be downloaded from the WithSecure Download Center.

UPDATE: 2024-09-25: This upgrade has now been published as WithSecure Capricorn Engine (2024-09-25_04). Please note that due to the way clients check for updates, some customers will not receive this until slightly later in the day. Subsequent Capricorn updates will also include this change.

UPDATE 2024-09-24: We anticipate that this update will start being delivered to our customers from 9.00 UTC 25.09.2024, but it is unfortunately not possible to give an exact time due to the way client installations check for updates. The update size will be ~39MB, and not the 42,6MB announced earlier

We plan to release a major Capricorn database update on September 24th, 2024.

What does this update mean?

This update signifies that all Withsecure Endpoint products – across Windows, Mac, and Linux platforms (those utilizing the Capricorn engine) will now download a larger update package of approximately 42,6 MB, compared to the usual 5MB.

For customers managing large environments or dealing with bandwidth constraints, this information could be particularly relevant. Additionally, users can expect improved initialization times and reduced memory consumption as part of the update’s benefits.

The update is provided automatically and does not require any additional configuration.

• The release time will be announced 24 hours in advance through our community channels.
• Updates containing this release will start with “WithSecure Capricorn Engine (2024-09-xx-xx)”
• Users of WithSecure Elements EPP may wish to consider taking the Elements Connector into use, to help reduce internet access, if they have several deployed endpoints. You can find more details of how to deploy this at https://www.withsecure.com/userguides/data/pdf/ws_elements_connector_eng.pdf

If you are using an F-Secure branded B2B product, please read on, as this article contains information you need to ensure protection and functionality continues in 2025.

We have previously communicated to our partners and end customers that support for F-Secure branded on-premises products will end completely in late 2024. This information was also published in this article.

As part of infrastructure changes related to our separation from F-Secure, the update servers for the old products will cease to exist. Support ends for these older products at the end of September in most cases, but we will endeavour to continue providing protection updates for these until the end of the year.

As we roll into 2025, it will be IMPOSSIBLE for us to offer any support for these products, as we will have no possibility to provide updates to these products. The products will stop receiving updates, and will no longer provide protection. To ensure continued delivery of updates, and therefore protection of your systems, it is vitally important that you update systems before the deadline.

In particular, this end of support reminder affects the following products, including Premium versions. You can find the minimum supported version.

Replacement WithSecure branded versions are available for all of these products at our download center.

Please note that some service network addresses have changed for these WithSecure-branded products, and our customers need to ensure that connectivity is allowed to the new addresses. You can find more information at the dedicated article

Partners and customers have already received keycodes for the new versions where applicable.

On-premises products that are branded as WithSecure, and all WithSecure Elements products, continue to be supported until their published end of life dates.

From time to time, WithSecure updates its Terms of Use for our products and services. These Terms of Use have earlier also been named “End User License Terms” or “End User License Agreement”.

Why are we changing the terms of use?

As we have also stated in our terms of use, our products and services are improved from time to time and therefore the terms of use also need updating from time to time.

Mainly the changes for this version are stylistic and minor. The updated terms of use are materially similar as in the previous version.

When are these being changed?

The new terms will come into effect from 1 June 2024, with endpoint clients being updated to use them soon afterwards. Until then, the existing terms of use apply.

What do I need to do as a Partner or End-Customer?

In short, nothing, but if you wish you can review the updated terms (in PDF format). These preview terms are currently only available in English, but will be available in other languages when the new terms come into use.

The updated terms will automatically be applied from 1 June 2024 onwards.

Note: Continued use of WithSecure™ products and services means acceptance of these new terms.

As Microsoft Extended Support for all Windows 8/8.1 versions ended during 2023, WithSecure will stop supporting these versions of Microsoft Windows from 31st March 2024.

This applies to all WithSecure products. This change does not affect the overall support for those products when they are used on supported operating systems.

Customers who are using these versions of Microsoft Windows are advised to upgrade them, or replace the devices, so that they can use versions of Windows that are supported by Microsoft. Both Microsoft and WithSecure strongly recommend that customers should only use supported versions of products, to maintain security and protection.

For users of WithSecure Elements, the “Devices” view can show unsupported operating systems, if the “OS End of Life” field is enabled.

In May 2024 we are releasing new versions of Countercept Agents for Windows, Linux and Mac platforms. Managed clients will get all these changes automatically. A little later we will publish new release groups to switch clients using managed updates in collaboration with the WithSecure Engagement team.After the upgrade new versions of Countercept Agents will start using new addresses.

For many customers, WithSecure products will function correctly without needing to know which servers the products connect to.

However, some administrators tightly control which network addresses they allow their clients to connect to (“Egress control” or “outbound connections”), and it is mandatory that they allow connections to the following addresses. WithSecure cannot guarantee the functionality of the products if access to these addresses is blocked.

The product may not function correctly if access to these network addresses is not allowed.

Please note that all the following require outbound connections to TCP/443 unless otherwise stated.

Additionally, any products listed in this document also includes F-Secure branded versions of the same products.

Recommendations

WithSecure recommends, where possible, that administrators allow outbound access to all address under the withsecure.com and fsapi.com domains. We do appreciate that this is not always possible due to firewall configuration limitations, or even from an operational perspective, so we are publishing an explicit list of server addresses.

Please note that we do not guarantee this list of addresses is complete or will stay unchanged, so we strongly recommend bookmarking these articles for future reference. We will update these articles whenever needed.

WithSecure Countercept

New addresses

After the upgrade new versions of Countercept Agents will start using new addresses.

Please note that all the following services require outbound connections to TCP/443 unless otherwise stated.

In addition, the use of an asterisk (*) below means that all hosts under that subdomain should be allowed (wildcard allow).

• *.fsapi.com (also port 80)
• ac3ujg1ortm4c-ats.iot.eu-west-1.amazonaws.com (also port 8883, if the network includes Windows 7, Windows Server 2008 R2, or Windows Server 2012 endpoints)
• c3hquxgihnj763.credentials.iot.eu-west-1.amazonaws.com
• ew1-famp-prd-system-transfer.s3.eu-west-1.amazonaws.com
• *.digicert.com

If you are unable to allowlist wildcard, either from a technical or operational standpoint, please contact your WithSecure Engagement Manager who will be pleased to advise you further.

Connectivity Checker

We also provide tools that can assist you in checking whether your firewall allows the needed external connections.

For Microsoft Windows

Download the Connectivity Tool from WithSecure™ Support Tools library. Support Tools library, or using direct download link https://download.withsecure.com/connectivitytool/ConnectionChecker.exe

Run the tool on the machine where the installation is being attempted by double clicking on the tool through Windows Explorer. The tool will prompt for administrator credentials when it runs.

Select MDR product from the list.

If a proxy is going to be used for the installation, it must be defined when prompted. If a proxy is not going to be used, leave the proxy settings empty.

For Linux and Mac

Download the Connectivity Checker tool with the direct link https://download.withsecure.com/connectivitytool/wsconnectionchecker.zip

Unpack the tool with: unzip wsconnectionchecker.zip

Set execution bit if needed:

sudo chmod +rwx wsconnectionchecker

Run the tool in Linux or Mac mode depending on your needs. If a proxy is going to be used for the installation, it must be defined with the -p parameter. If a proxy is not going to be used use parameter ‘-d’ instead, for example:

.\wsconnectionchecker -o linux -p http://myproxy.com:3128

or

.\wsconnectionchecker -o mac -d