CVE-2025-61932: Lanscope Endpoint Manager improper origin verification allows RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityCVSS 4.0 base score is 9.3 with no privileges or user interaction required, and the CVE is in CISA KEV with a 2025-11-12 remediation deadline.

What it is

Lanscope Endpoint Manager (On-Premises), in both the Client program (MR) and Detection agent (DA), does not properly verify the origin of incoming requests. An attacker can send specially crafted packets to trigger arbitrary code execution. The flaw is remotely reachable without authentication or user interaction and is listed in CISA KEV, so it warrants urgent attention.

Impact

An unauthenticated attacker can execute arbitrary code on affected endpoints or servers, giving full control of the compromised component and a foothold for lateral movement.

Attack surface

Reachable over the network via crafted packets to the MR client program and DA detection agent; the CVSS 4.0 vector shows no privileges or user interaction required. No further detail on the specific port or protocol is provided in the record.

Exploitation

CVE-2025-61932 was added to CISA KEV on 2025-10-22 with a remediation due date of 2025-11-12, indicating known exploitation; EPSS 30-day probability is 0.02628 (84.7th percentile). No ransomware campaign use is documented.

What to do

• Apply the vendor fix from the Motex advisory (release251020) as the first action; confirm the patched MR and DA versions.
• If patching is not immediately possible, restrict network access to the MR client program and DA detection agent to trusted management hosts only.
• Follow CISA BOD 22-01 guidance and the KEV required action; discontinue use of the product if mitigations are unavailable.
• Monitor vendor and JVN advisories for updated guidance and interim workarounds.
• Inventory all on-premises Lanscope Endpoint Manager deployments, including MR and DA components, to ensure none are missed.

Detection

• Hunt for unexpected or malformed packets reaching MR and DA listeners from non-management hosts.
• Review endpoint and server logs for process creation or code execution originating from the Lanscope MR/DA service context.
• Alert on new outbound connections or child processes spawned by Lanscope components.
• Correlate network telemetry for anomalous traffic to Lanscope management ports with host-based execution events.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.