CVE-2026-25785
📋 TL;DR
A path traversal vulnerability in Lanscope Endpoint Manager (On-Premises) Sub-Manager Server allows attackers to access arbitrary files outside intended directories. This can lead to file tampering and remote code execution. Organizations using affected versions of this endpoint management software are at risk.
💻 Affected Systems
- Lanscope Endpoint Manager (On-Premises) Sub-Manager Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with administrative privileges, data exfiltration, ransomware deployment, and lateral movement across the network.
Likely Case
Unauthorized file access leading to credential theft, configuration manipulation, and installation of backdoors or malware.
If Mitigated
Limited file access if proper network segmentation and file permissions are enforced, but still significant risk.
🎯 Exploit Status
Path traversal vulnerabilities typically require minimal technical skill to exploit once details are known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Ver.9.4.7.4 or later
Vendor Advisory: https://www.motex.co.jp/news/notice/2026/release260225/
Restart Required: Yes
Instructions:
1. Download the latest version from the vendor portal. 2. Backup current configuration and data. 3. Run the installer to upgrade. 4. Restart the Sub-Manager Server service. 5. Verify functionality.
🔧 Temporary Workarounds
Network Segmentation
allIsolate the Sub-Manager Server from untrusted networks and limit access to authorized IPs only.
File System Permissions
windowsRestrict the application's service account to minimal necessary file system permissions.
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the Sub-Manager Server
- Deploy application control/whitelisting to prevent unauthorized code execution
🔍 How to Verify
Check if Vulnerable:
Check the installed version in the Lanscope Endpoint Manager console under System Information or About.Check Version:
Check the application's About dialog or installed programs list in Windows.Verify Fix Applied:
Confirm version is 9.4.7.4 or later and test file access functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns from the Sub-Manager Server process
- Multiple failed path traversal attempts in web/application logs
Network Indicators:
- Unexpected outbound connections from the Sub-Manager Server
- Traffic to known malicious IPs
SIEM Query:
source="lanscope_logs" AND (event="file_access" AND path="..\\" OR path="../")