CVE-2025-61932
Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability
Description
CVE-2025-61932 is a critical vulnerability in Motex LANSCOPE Endpoint Manager (On-Premises) affecting both the Client program (MR) and Detection agent (DA) components. The flaw involves improper verification of the source of a communication channel, allowing an attacker to execute arbitrary code by sending specially crafted packets. With a CVSS v3.0 base score of 9.8 and an EPSS score of 8.1% (92.0th percentile), this vulnerability poses a significant risk. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 12, 2025.
KEV Information
CVSS Score
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| motex | lanscope endpoint manager | < 9.3.2.7; >= 9.3.3.0, < 9.3.3.9; >= 9.4.0.0, < 9.4.0.5; >= 9.4.1.0, < 9.4.1.5; >= 9.4.2.0, < 9.4.2.6; >= 9.4.3.0, < 9.4.3.8; >= 9.4.4.0, < 9.4.4.6; >= 9.4.5.0, < 9.4.5.4; >= 9.4.6.0, < 9.4.6.3; >= 9.4.7.0, <= 9.4.7.1 |
References
- https://jvn.jp/en/jp/JVN86318557/(Third Party Advisory)
- https://www.motex.co.jp/news/notice/2025/release251020/(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61932(Third Party Advisory, US Government Resource)
Weakness Type
CWE-940: Improper Verification of Source of a Communication Channel
CWE-940 describes a weakness where software does not properly verify the identity or origin of a communication channel before processing the data received through it. In CVE-2025-61932, the LANSCOPE Endpoint Manager client and detection agent components fail to validate where incoming network packets originate from, allowing an attacker to send malicious packets that are processed as if they came from a trusted source. This leads directly to arbitrary code execution on the target system.
Impact Analysis
The business impact of CVE-2025-61932 is critical across all three security dimensions. Confidentiality impact is high because successful code execution on endpoint management agents gives the attacker access to all data on the compromised endpoint, including sensitive corporate data, credentials, and monitoring information collected by the agent. Integrity impact is high as the attacker can modify files, install malware, alter agent configurations, and potentially pivot to disable endpoint security controls. Availability impact is also high, as the attacker could crash the agent, disrupt endpoint management operations, or deploy destructive payloads.
The EPSS score of 8.1% (92.0th percentile) indicates elevated exploitation probability. The vulnerability is particularly concerning because endpoint management agents typically run with elevated system privileges and are deployed across large numbers of workstations and servers. Compromising the agent could give an attacker a foothold on every managed endpoint in the organization. The ransomware association is listed as unknown, but the widespread deployment of endpoint agents and the potential for lateral movement make this an attractive target for threat actors. Organizations relying on LANSCOPE Endpoint Manager for their device management and security monitoring face both operational and security risks from this vulnerability.
Exploit Maturity
CVE-2025-61932 has been added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of November 12, 2025, confirming that exploitation has been observed in the wild. The EPSS score of 8.1% (92.0th percentile) reflects meaningful exploitation probability above the vast majority of tracked vulnerabilities. While no specific public exploit tool has been widely circulated, the inclusion in the KEV catalog indicates threat actors have successfully weaponized this vulnerability. The ransomware usage status is currently unknown. The advisory from JVN (Japan Vulnerability Notes) and the vendor advisory from Motex provide technical context but do not detail specific exploitation campaigns.
Remediation
- Update LANSCOPE Endpoint Manager to the latest patched version. Motex has released fixes across multiple version branches. Apply the appropriate update: version 9.3.2.7+ for the 9.3.2 branch, 9.3.3.9+ for 9.3.3, 9.4.0.5+ for 9.4.0, 9.4.1.5+ for 9.4.1, 9.4.2.6+ for 9.4.2, 9.4.3.8+ for 9.4.3, 9.4.4.6+ for 9.4.4, 9.4.5.4+ for 9.4.5, 9.4.6.3+ for 9.4.6, and versions above 9.4.7.1 for the 9.4.7 branch. Refer to the Motex advisory for detailed upgrade instructions.
- Deploy network segmentation around managed endpoints. Restrict which systems can send management packets to LANSCOPE agents by implementing firewall rules that only allow communication from legitimate LANSCOPE management servers.
- Monitor for indicators of compromise on managed endpoints. Review system logs on endpoints running the LANSCOPE agent for unexpected process creation, unusual network connections, or modifications to agent configuration files that could indicate prior exploitation.
- Verify agent integrity after patching. After applying updates, confirm that the LANSCOPE client program and detection agent are running the expected patched versions and have not been tampered with.
- Review network traffic logs for anomalous packets. Inspect network monitoring data for unusual communication patterns targeting LANSCOPE agent ports that may indicate scanning or exploitation attempts.
Technical Details
The CVSS v3.0 base score for CVE-2025-61932 is 9.8 (Critical) with the vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Attack Vector (AV:N) indicates the vulnerability can be exploited remotely over the network. Attack Complexity (AC:L) means no special conditions are needed. Privileges Required (PR:N) confirms no authentication is required, and User Interaction (UI:N) means no victim action is needed. Scope (S:U) is unchanged, and all three impact metrics — Confidentiality (C:H), Integrity (I:H), and Availability (A:H) — are rated high.
The underlying technical issue is that the LANSCOPE Endpoint Manager client program (MR) and detection agent (DA) do not properly verify the origin of incoming network communications. An attacker can craft network packets that appear to come from a legitimate LANSCOPE management server. Because the agent does not validate the source of these communications, it processes the malicious packets as trusted instructions. The specially crafted packets contain payloads that, when processed by the agent, result in arbitrary code execution on the target system. Given that endpoint management agents typically operate with SYSTEM-level privileges, successful exploitation grants the attacker full control over the compromised endpoint.
Frequently Asked Questions
What is CVE-2025-61932?
CVE-2025-61932 is a critical remote code execution vulnerability in Motex LANSCOPE Endpoint Manager affecting both the client program and detection agent components. It allows an unauthenticated attacker to execute arbitrary code by sending specially crafted network packets to the agent, which fails to verify the source of incoming communications.
Which versions of LANSCOPE Endpoint Manager are affected?
Multiple version branches are affected, spanning from versions prior to 9.3.2.7 through 9.4.7.1 and earlier. Motex has released patches for each affected branch, and organizations should update to the specific patched version corresponding to their installed branch.
Is CVE-2025-61932 being actively exploited?
Yes. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of November 12, 2025, indicating confirmed exploitation in the wild. The EPSS score of 8.1% places it in the 92nd percentile for exploitation probability.
Can this vulnerability be exploited remotely?
Yes. The vulnerability has a network attack vector with no authentication required and no user interaction needed. An attacker only needs network access to the ports used by the LANSCOPE agent to send specially crafted packets and achieve code execution.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.