LANSCOPE Endpoint Manager on-premises contains a critical RCE vulnerability…
LANSCOPE Endpoint Manager on-premises contains a critical RCE vulnerability (CVE-2025-61932) exploitable via crafted packets, with active exploitation confirmed in customer environments.
MOTEX Corporation's LANSCOPE Endpoint Manager on-premises edition, an endpoint management tool, contains a critical vulnerability allowing remote code execution without authentication. The flaw stems from improper source verification in communication channels. Attackers can exploit this by sending specially crafted packets to vulnerable instances, enabling arbitrary code execution on the target system. The vendor has confirmed active exploitation in customer environments, with malicious packets being received from external sources. All versions up to and including 9.4.7.1 are affected, specifically the Client Program (MR) and Detection Agent (DA) components. The cloud-based version of LANSCOPE Endpoint Manager is not vulnerable. MOTEX has released patches and workarounds to address this issue.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by LANSCOPE Endpoint Manager Client/Agent
Detects command interpreters or scripting engines spawned as children of the LANSCOPE Endpoint Manager MR (Client Program) or DA (Detection Agent) processes, consistent with exploitation of the unauthenticated RCE vulnerability that allows arbitrary code execution via crafted packets. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process from LANSCOPE Endpoint Manager MR/DA Process
id: 7a159e52-a3ee-57ea-aabe-48fc6c2a0ac4
status: experimental
description: Detects cmd.exe, powershell.exe, rundll32.exe, mshta.exe, or wscript/cscript
spawned by the LANSCOPE Endpoint Manager Client Program (MR) or Detection Agent
(DA) processes. These service processes normally do not spawn interactive shells
or scripting engines; such behaviour is consistent with exploitation of CVE-affected
LANSCOPE Endpoint Manager on-premises RCE via crafted network packets.
references:
- https://www.motex.co.jp
author: Vorant
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains:
- \MR.exe
- \DA.exe
- \LanScope\
- \MotEx\
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \rundll32.exe
- \mshta.exe
- \wscript.exe
- \cscript.exe
condition: selection_parent and selection_child
falsepositives:
- Legitimate LANSCOPE agent update or maintenance scripts invoked by administrators
- Scheduled inventory or software distribution scripts triggered by the endpoint manager
level: high
tags:
- attack.t1203
- attack.t1190
- attack.execution
New Executable or Script Dropped in LANSCOPE Endpoint Manager Install Directory
Detects creation of new executable, script, or web shell files within the LANSCOPE Endpoint Manager installation directory, which may indicate post-exploitation file drop following remote code execution against the exposed MR/DA components. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: File Write to LANSCOPE Endpoint Manager Install Directory
id: 72798b62-cf72-5642-a662-4e090dda6b7f
status: experimental
description: Detects creation of executable, script, or web-accessible files inside
the LANSCOPE Endpoint Manager (MOTEX) install directory shortly after exposure to
unauthenticated network input. Attackers exploiting the unauthenticated RCE in LANSCOPE
MR/DA components may drop implants or web shells into the product's install path
for persistence.
references:
- https://www.motex.co.jp
author: Vorant
logsource:
category: file_event
product: windows
detection:
selection_path:
TargetFilename|contains:
- \LanScope\
- \MotEx\
selection_ext:
TargetFilename|endswith:
- .exe
- .dll
- .bat
- .ps1
- .vbs
- .jsp
- .asp
- .aspx
- .php
condition: selection_path and selection_ext
falsepositives:
- Legitimate LANSCOPE agent upgrades or patch installations writing new binaries
- Vendor-signed maintenance packages updating DLLs in the install directory
level: medium
tags:
- attack.t1190
- attack.persistence
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2025/20251020-jvn.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free