Published: October 20, 2025
A critical vulnerability identified as CVE-2025-61932 has been discovered in LANSCOPE Endpoint Manager (On-Premises) developed by Motex Inc. (Japan).
The issue stems from Improper Verification of Source of a Communication Channel (CWE-940) and allows remote attackers to execute arbitrary code by sending specially crafted packets to a vulnerable endpoint.
This vulnerability has been added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog, confirming that it is being actively exploited in the wild.
Technical Summary
- Affected Product: LANSCOPE Endpoint Manager (On-Premises) – Client (MR) and Detection Agent (DA) components.
- Unaffected Component: The Management Server is not affected.
- Affected Versions: All versions up to 9.4.7.1 are vulnerable.
- Fixed Versions: 9.3.2.7, 9.3.3.9, 9.4.0.5, 9.4.1.5, 9.4.2.6, 9.4.3.8, 9.4.4.6, 9.4.5.4, 9.4.6.3, 9.4.7.3.
- Vulnerability Type: Improper source verification in communication channels.
- Exploit Vector: Remote, over TCP port 443 (HTTPS).
- CVSS v4.0 Score: 9.3 (Critical)
- CVSS v3.x Score: 9.8 (Critical)
- Impact: Complete system compromise — confidentiality, integrity, and availability all at high risk.
- Discovery & Exploitation: First observed exploited in the wild around April 2025.
Global and Regional Relevance
Although this vulnerability primarily affects customers in Japan, global exposure is confirmed.
Many organizations in Europe (especially Germany, the Netherlands, and the U.K.) and North America have integrated LANSCOPE for endpoint management in hybrid enterprise networks.
CISA has issued an emergency directive requiring U.S. federal agencies to patch CVE-2025-61932 by November 12, 2025, emphasizing the seriousness of this issue.
The Japan CERT (JPCERT/CC) also reported unauthorized packet traffic consistent with the exploit in domestic enterprise networks.
Potential Business Impact
For organizations in Europe, including Germany and the EU, this vulnerability presents a severe cybersecurity and compliance risk:
- Remote Code Execution (RCE): Attackers can gain full control of endpoints.
- Data Privacy Concerns: Unauthorized data access could trigger GDPR violations, exposing companies to heavy penalties.
- Operational Downtime: System compromise can disrupt business operations and endpoint visibility.
- Lateral Movement: Attackers may pivot to internal networks, compromising domain controllers or confidential data stores.
Recommended Mitigation Steps
1. Identify Affected Systems
Immediately verify if LANSCOPE Endpoint Manager (On-Premises) is deployed within your environment and check the exact version numbers.
2. Apply Security Updates
Upgrade all affected Client (MR) and Detection Agent (DA) components to one of the patched versions (≥ 9.4.7.3).
The Management Server component is reportedly not impacted, but patch anyway as a precaution.
3. Restrict Network Access
If LANSCOPE endpoints are accessible from external networks, limit access to trusted IPs or VPN users only.
Temporarily disable external connectivity on TCP 443 until the update is confirmed.
4. Monitor Logs and Network Traffic
Review server and endpoint logs for unusual activity.
Look for suspicious inbound connections or crafted HTTPS packets on port 443.
Check for Indicators of Compromise (IoCs) shared by Motex or security vendors.
5. Strengthen Endpoint Security
Ensure strong authentication, least privilege configurations, endpoint firewalls, and continuous monitoring are enforced.
6. Communicate Internally
Notify your IT Security and Compliance teams immediately.
Set a clear patch deadline (preferably before November 12, 2025).
7. Validate After Patching
After applying updates, test system stability and verify that no endpoints remain exposed to public access.
About LANSCOPE Endpoint Manager
LANSCOPE Endpoint Manager is an enterprise endpoint management and security solution developed by Motex Inc. (Japan). It helps organizations monitor, manage, and protect corporate devices such as PCs and servers across on-premises and remote environments.
Key features include:
- Asset Management: Tracks hardware and software inventory.
- User Activity Monitoring: Logs usage behavior for compliance and insider threat detection.
- Patch & Policy Management: Ensures devices remain secure and up to date.
- Access Control & Device Auditing: Helps IT teams enforce security policies and prevent data leaks.
It is widely used in Japan and Asia for corporate IT governance, endpoint visibility, and data loss prevention.
Conclusion
CVE-2025-61932 is a critical, actively exploited vulnerability that allows remote attackers to gain full control of affected systems.
With a CVSS score above 9 and confirmed exploitation in the wild, organizations worldwide — especially those in Europe and Asia — must prioritize patching immediately.
Proactive measures such as strict access control, real-time monitoring, and continuous vulnerability management can greatly reduce exposure.
