Lanscope Endpoint Manager On-Premises Client Remote Code Execution Vulnerability Advisory (CVE-2025-61932)
Executive & SecOps Summary
SECOPS ASSESSMENTLanscope Endpoint Manager (On-Premises) Client program (MR) and Detection agent (DA)
Unauthenticated remote attackers can execute arbitrary code with system privileges by sending specially crafted packets to the agent
Immediately apply the official security patches provided by Motex and restrict network access to the agent communication ports
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the latest security patches provided by the vendor (Motex). For environments without automatic updates, deploy the updated agent package silently using administrative tools.
# Example of silent installation command for Lanscope Agent update
# Replace the installer name and parameters according to the official vendor guide.
LanscopeAgentSetup.exe /s /v'/qn REBOOT=ReallySuppress'2. Temporary Workaround & Hardening Configuration
Until patches can be applied, restrict network access to the Lanscope agent ports. Configure host-based firewalls to only accept traffic from the authorized Lanscope management server IP address.
# Restrict Lanscope Agent ports (e.g., 50000-50010) using Windows Firewall
# Replace '192.168.1.100' with your actual Lanscope Management Server IP.
New-NetFirewallRule -DisplayName 'Block Unauthorized Lanscope Agent Access' `
-Direction Inbound `
-Action Block `
-Protocol TCP `
-LocalPort 50000-50010
New-NetFirewallRule -DisplayName 'Allow Authorized Lanscope Server' `
-Direction Inbound `
-Action Allow `
-Protocol TCP `
-LocalPort 50000-50010 `
-RemoteAddress '192.168.1.100'3. Log Audit & IoC Verification Commands
Inspect endpoints for anomalous child processes spawned by the Lanscope agent process, which may indicate successful exploitation.
# Detect anomalous child processes spawned by Lanscope agent processes
Get-CimInstance Win32_Process | Where-Object {
$_.ParentProcessId -in (Get-Process -Name '*lanscope*' -ErrorAction SilentlyContinue).Id
} | Select-Object ProcessId, Name, CommandLine, CreationDate | Format-Table -AutoSizeBlock Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-61932) is an input validation and origin verification flaw (CWE-940) in the Client program (MR) and Detection agent (DA) of Lanscope Endpoint Manager (On-Premises). The root cause lies in the agent's failure to properly verify the origin of incoming network requests, allowing unauthorized network packets to be processed as trusted administrative commands.
2. Exploitation Mechanics & Attack Scenario
An attacker can target the listening ports of the Lanscope agent by sending specially crafted TCP/UDP packets. Because the agent does not validate whether the packet originated from a legitimate management server, it parses and executes the payload embedded within the packet. Since this process requires no authentication or user interaction (AV:N/AC:L/PR:N/UI:N), an attacker can achieve remote code execution (RCE) on any exposed agent.
3. Infrastructure & Business Impact
Since Lanscope Endpoint Manager is deployed across numerous enterprise endpoints for management purposes, exploitation of this vulnerability can serve as an entry point for lateral movement within the internal network. Given its active exploitation status and inclusion in the CISA KEV catalog, unpatched systems face an imminent risk of ransomware deployment and sensitive data exfiltration.
Official Vendor Advisories & References
Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets.
Frequently Asked SecOps Questions (CVE-2025-61932)
FAQQ1. How critical is CVE-2025-61932 and is it actively exploited in the wild?
CVE-2025-61932 is rated CVSS 9.3 (CRITICAL) with a 30-day EPSS exploitation probability of 2.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-61932?
Primary impacted vendors include motex across lanscope endpoint manager. Scope summary: All unpatched versions of Lanscope Endpoint Manager (On-Premises) Client program (MR) and Detection agent (DA)
Q3. What temporary mitigations or workarounds exist for CVE-2025-61932 before patching?
[Mitigation] Immediately apply the official security patches provided by Motex and restrict network access to the agent communication ports Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-61932
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (motex)
View Category →Apple macOS Screen Sharing Authentication Bypass Vulnerability (CVE-2026-65400)
[Affected Scope] macOS systems running versions prior to Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1/26.7, or Golden Gate 27 with Screen Sharing or VNC services enabled
DAEMON Tools Lite Official Installer Supply Chain Attack and Trojanized Binaries (CVE-2026-8398)
[Affected Scope] DAEMON Tools Lite Windows versions 12.5.0.2421 through 12.5.0.2434 distributed between April 8, 2026, and May 5, 2026
Microsoft Windows Shell Command Injection and Security Feature Bypass (CVE-2026-96951) Advisory
[Affected Scope] All supported versions of Windows OS including Windows 10, 11, and Windows Server.
Apple iOS and macOS Out-of-bounds Write Remote Code Execution Vulnerability (CVE-2026-86950) Security Advisory
[Affected Scope] All Apple devices running versions prior to iOS 18.7.11/26.7.1 and macOS Sequoia 15.8.1/Tahoe 26.7.1.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.