{"id":"CVE-2025-61932","kind":"vulnerability","aliases":["CVE-2025-61932"],"related":[],"title":"motex lanscope endpoint manager: Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the…","description":"Motex LANSCOPE Endpoint Manager contains an improper verification of source of a communication channel vulnerability allowing an attacker to execute arbitrary code by sending specially crafted packets.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Motex LANSCOPE Endpoint Manager, a Windows endpoint management product, fails to verify the source of a communication channel. An attacker who sends specially crafted packets can run arbitrary code on the affected system.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2025-10-22T00:00:00+00:00","products":[{"name":"motex lanscope endpoint manager","fixed":["9.3.2.7"],"affected":"< 9.3.2.7","ecosystem":"vendor"},{"name":"motex lanscope endpoint manager","fixed":["9.3.3.9"],"affected":">= 9.3.3.0, < 9.3.3.9","ecosystem":"vendor"},{"name":"motex lanscope endpoint manager","fixed":["9.4.0.5"],"affected":">= 9.4.0.0, < 9.4.0.5","ecosystem":"vendor"},{"name":"motex lanscope endpoint manager","fixed":["9.4.1.5"],"affected":">= 9.4.1.0, < 9.4.1.5","ecosystem":"vendor"},{"name":"motex lanscope endpoint manager","fixed":["9.4.2.6"],"affected":">= 9.4.2.0, < 9.4.2.6","ecosystem":"vendor"},{"name":"motex lanscope endpoint manager","fixed":["9.4.3.8"],"affected":">= 9.4.3.0, < 9.4.3.8","ecosystem":"vendor"},{"name":"motex lanscope endpoint manager","fixed":["9.4.4.6"],"affected":">= 9.4.4.0, < 9.4.4.6","ecosystem":"vendor"},{"name":"motex lanscope endpoint manager","fixed":["9.4.5.4"],"affected":">= 9.4.5.0, < 9.4.5.4","ecosystem":"vendor"},{"name":"motex lanscope endpoint manager","fixed":["9.4.6.3"],"affected":">= 9.4.6.0, < 9.4.6.3","ecosystem":"vendor"},{"name":"motex lanscope endpoint manager","fixed":[],"affected":">= 9.4.7.0, <= 9.4.7.1","ecosystem":"vendor"},{"name":"Motex LANSCOPE Endpoint Manager","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["endpoint-management","exploited","other","self-hosted","windows"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the mitigations listed by the vendor (Motex) for CVE-2025-61932, or discontinue use of the product if mitigations are unavailable, per CISA guidance.","status":"open","published_at":"2025-10-20T08:15:33+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:44:29+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-23T20:44:28Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations listed by the vendor (Motex) for CVE-2025-61932, or discontinue use of the product if mitigations are unavailable, per CISA guidance.","reach":"network","summary":"Motex LANSCOPE Endpoint Manager, a Windows endpoint management product, fails to verify the source of a communication channel. An attacker who sends specially crafted packets can run arbitrary code on the affected system.","category":"other","who_cares":["windows","self-hosted","endpoint-management"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the endpoint manager server via crafted packets.","analyst_note":"Find Motex's advisory and the affected/fixed version list and the vendor mitigation steps; the KEV entry does not name versions or ports.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000438,"input_tokens":2581,"output_tokens":359,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':151C '-2025':21A,24A '-61932':22A,25A '22':150C 'action':141C 'affect':110B 'agent':16A 'allow':127C 'appli':142C 'applic':148C 'arbitrari':106B,132C 'attack':98B,129C 'bod':149C 'channel':96B,125C 'cisa':139C 'client':11A 'cloud':154C 'code':107B,133C 'communic':95B,124C 'contain':116C 'craft':102B,137C 'cve':20A,23A 'da':17A 'detect':15A 'discontinu':157C 'endpoint':3A,6A,28A,32A,36A,40A,44A,48A,52A,56A,60A,64A,68A,71B,81B,85B,114C 'endpoint-manag':70B 'execut':131C 'exploit':73B 'fail':88B 'follow':147C 'guidanc':152C 'host':77B 'improp':18A,118C 'instruct':146C 'lanscop':2A,5A,80B,113C 'lanscope':27A,31A,35A,39A,43A,47A,51A,55A,59A,63A,67A 'manag':4A,7A,72B,82B,86B,115C 'manager':29A,33A,37A,41A,45A,49A,53A,57A,61A,65A,69A 'mitig':143C,163C 'motex':1A,26A,30A,34A,38A,42A,46A,50A,54A,58A,62A,66A,79B,112C 'mr':13A 'on-premis':8A 'packet':103B,138C 'per':144C 'premis':10A 'product':87B,161C 'program':12A 'requir':140C 'run':105B 'self':76B 'self-host':75B 'send':100B,135C 'servic':155C 'sourc':92B,121C 'special':101B,136C 'system':111B 'unavail':165C 'use':158C 'vendor':145C 'verif':119C 'verifi':19A,90B 'vulner':126C 'window':78B,84B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-10-20T08:15:33+00:00","kev":{"dateAdded":"2025-10-22","dueDate":"2025-11-12","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vultures@jpcert.or.jp","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-61932","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-61932","severity":null,"published_at":"2025-10-22T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:14+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-61932","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61932","severity":null,"published_at":"2025-10-20T08:15:33+00:00","modified_at":"2026-10-08T22:10:00+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}