# LANSCOPE Endpoint Manager on-premises contains a critical RCE vulnerability…

Published: 2025-10-19 · Severity: critical
Canonical: https://vorant.io/reports/1062e0df-f685-4ac5-895d-ec2af4513e70/lanscope-endpoint-manager-on-premises-contains-a-critical-rce-vulnerability

> LANSCOPE Endpoint Manager on-premises contains a critical RCE vulnerability (CVE-2025-61932) exploitable via crafted packets, with active exploitation confirmed in customer environments.

MOTEX Corporation's LANSCOPE Endpoint Manager on-premises edition, an endpoint management tool, contains a critical vulnerability allowing remote code execution without authentication. The flaw stems from improper source verification in communication channels. Attackers can exploit this by sending specially crafted packets to vulnerable instances, enabling arbitrary code execution on the target system. The vendor has confirmed active exploitation in customer environments, with malicious packets being received from external sources. All versions up to and including 9.4.7.1 are affected, specifically the Client Program (MR) and Detection Agent (DA) components. The cloud-based version of LANSCOPE Endpoint Manager is not vulnerable. MOTEX has released patches and workarounds to address this issue.

## Mentioned in this report

- Vulnerabilities: CVE-2025-61932 (KEV)

## Detection guidance (public sample)

### Suspicious Child Process Spawned by LANSCOPE Endpoint Manager Client/Agent

ATT&CK: T1203

Detects command interpreters or scripting engines spawned as children of the LANSCOPE Endpoint Manager MR (Client Program) or DA (Detection Agent) processes, consistent with exploitation of the unauthenticated RCE vulnerability that allows arbitrary code execution via crafted packets. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process from LANSCOPE Endpoint Manager MR/DA Process
id: 7a159e52-a3ee-57ea-aabe-48fc6c2a0ac4
status: experimental
description: Detects cmd.exe, powershell.exe, rundll32.exe, mshta.exe, or wscript/cscript
  spawned by the LANSCOPE Endpoint Manager Client Program (MR) or Detection Agent
  (DA) processes. These service processes normally do not spawn interactive shells
  or scripting engines; such behaviour is consistent with exploitation of CVE-affected
  LANSCOPE Endpoint Manager on-premises RCE via crafted network packets.
references:
- https://www.motex.co.jp
author: Vorant
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
    - \MR.exe
    - \DA.exe
    - \LanScope\
    - \MotEx\
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \rundll32.exe
    - \mshta.exe
    - \wscript.exe
    - \cscript.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate LANSCOPE agent update or maintenance scripts invoked by administrators
- Scheduled inventory or software distribution scripts triggered by the endpoint manager
level: high
tags:
- attack.t1203
- attack.t1190
- attack.execution
```

### New Executable or Script Dropped in LANSCOPE Endpoint Manager Install Directory

ATT&CK: T1190

Detects creation of new executable, script, or web shell files within the LANSCOPE Endpoint Manager installation directory, which may indicate post-exploitation file drop following remote code execution against the exposed MR/DA components. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: File Write to LANSCOPE Endpoint Manager Install Directory
id: 72798b62-cf72-5642-a662-4e090dda6b7f
status: experimental
description: Detects creation of executable, script, or web-accessible files inside
  the LANSCOPE Endpoint Manager (MOTEX) install directory shortly after exposure to
  unauthenticated network input. Attackers exploiting the unauthenticated RCE in LANSCOPE
  MR/DA components may drop implants or web shells into the product's install path
  for persistence.
references:
- https://www.motex.co.jp
author: Vorant
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
    - \LanScope\
    - \MotEx\
  selection_ext:
    TargetFilename|endswith:
    - .exe
    - .dll
    - .bat
    - .ps1
    - .vbs
    - .jsp
    - .asp
    - .aspx
    - .php
  condition: selection_path and selection_ext
falsepositives:
- Legitimate LANSCOPE agent upgrades or patch installations writing new binaries
- Vendor-signed maintenance packages updating DLLs in the install directory
level: medium
tags:
- attack.t1190
- attack.persistence
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2025/20251020-jvn.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1062e0df-f685-4ac5-895d-ec2af4513e70/lanscope-endpoint-manager-on-premises-contains-a-critical-rce-vulnerability.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup