CVE-2025-61932
📋 TL;DR
CVE-2025-61932 is a critical vulnerability in Lanscope Endpoint Manager (On-Premises) that allows unauthenticated remote attackers to execute arbitrary code by sending specially crafted packets. This affects both the Client program (MR) and Detection agent (DA) components. Organizations using vulnerable versions of Lanscope Endpoint Manager are at risk of complete system compromise.
💻 Affected Systems
- Lanscope Endpoint Manager (On-Premises)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining administrative privileges, deploying ransomware, stealing sensitive data, and pivoting to other network systems.
Likely Case
Initial foothold leading to lateral movement, data exfiltration, and deployment of additional malware payloads.
If Mitigated
Limited impact if network segmentation and strict firewall rules prevent exploitation attempts.
🎯 Exploit Status
CISA has added this to their Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in references; check vendor advisory for exact version
Vendor Advisory: https://www.motex.co.jp/news/notice/2025/release251020/
Restart Required: Yes
Instructions:
1. Review vendor advisory at provided URL. 2. Download and apply the latest patch from Lanscope/Motex. 3. Restart affected Lanscope services. 4. Verify patch application.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Lanscope management servers and agents from untrusted networks
Firewall Restrictions
allBlock unnecessary inbound traffic to Lanscope management ports
🧯 If You Can't Patch
- Immediately isolate affected systems from production networks
- Implement strict network access controls and monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check Lanscope Endpoint Manager version against vendor advisory. Monitor for unexpected network connections to Lanscope services.Check Version:
Check Lanscope console or agent properties for version informationVerify Fix Applied:
Verify patch installation through Lanscope management console and confirm version matches patched release.📡 Detection & Monitoring
Log Indicators:
- Unexpected process creation from Lanscope services
- Authentication failures or unusual access patterns
Network Indicators:
- Unusual outbound connections from Lanscope servers
- Suspicious packet patterns to Lanscope management ports
SIEM Query:
source="lanscope*" AND (event_type="process_creation" OR dest_port="[lanscope_port]" AND protocol="TCP")