VORANT. Threat Intelligence Sign in Get the full feed

LANSCOPE Endpoint Manager RCE flaw exploited

elevated vulnerability

A critical CVE-2025-61932 flaw in MOTEX LANSCOPE Endpoint Manager (on-premise) lets attackers achieve remote code execution via crafted packets, with real-world exploitation confirmed.

IPA/JVN issued an advisory for CVE-2025-61932, a critical vulnerability (CVSS v3 9.8) in MOTEX's LANSCOPE Endpoint Manager on-premise edition, affecting the client program (MR) and detection agent (DA) in versions 9.4.7.1 and earlier. The flaw stems from insufficient source validation of the product's communication channel, allowing an attacker who sends specially crafted packets to execute arbitrary code on the affected system.

The vendor has confirmed that malicious packets originating from external sources have already been observed hitting customer environments, indicating active exploitation attempts in the wild rather than a purely theoretical risk. The cloud version of LANSCOPE Endpoint Manager is not affected. Organizations running the on-premise version are urged to update to the patched release or apply the vendor's workaround immediately, given the endpoint management tool's typically privileged position within enterprise networks.

Mentioned in this report

Vulnerabilities CVE-2025-61932KEV

Related reporting

Detection guidance

LANSCOPE Endpoint Manager Suspicious Network Communication

ATT&CK T1210

Detects network connections from LANSCOPE client/agent processes (MR.exe, DA.exe) to unexpected remote hosts, indicating potential exploitation of CVE-2025-61932. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: LANSCOPE Endpoint Manager Suspicious Network Communication
description: Detects LANSCOPE Endpoint Manager client (MR) or detection agent (DA)
  processes initiating unexpected outbound network connections. CVE-2025-61932 allows
  remote code execution via specially crafted packets; this rule triggers on anomalous
  network communication from affected processes that may indicate exploitation.
tags:
- attack.t1210
- cve.2025.61932
logsource:
  category: network_connection
  product: windows
detection:
  selection_lanscope_process:
    Image|endswith:
    - \MR.exe
    - \DA.exe
  selection_lanscope_path:
    Image|contains: LANSCOPE
  selection_outbound:
    Initiated: 'true'
  filter_local_subnet:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
  filter_lanscope_server:
    DestinationHostname|contains: lanscope
  condition: (selection_lanscope_process or selection_lanscope_path) and selection_outbound
    and not (filter_local_subnet or filter_lanscope_server)
falsepositives:
- Legitimate LANSCOPE communication to internal management servers with non-standard
  hostnames
- Misconfigured LANSCOPE deployments routing through external proxies
level: high
id: ded0d830-8302-5da3-818d-cd55da9dded9
status: experimental
author: Vorant

LANSCOPE Endpoint Manager Unexpected Child Process Creation

ATT&CK T1210

Detects LANSCOPE client/agent processes spawning unexpected child processes, indicative of post-exploitation code execution from CVE-2025-61932. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: LANSCOPE Endpoint Manager Unexpected Child Process Creation
description: Detects LANSCOPE Endpoint Manager processes (MR.exe, DA.exe) spawning
  suspicious child processes. CVE-2025-61932 allows arbitrary code execution; this
  rule identifies process creation from affected services that may indicate successful
  exploitation.
tags:
- attack.t1210
- cve.2025.61932
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent_lanscope:
    ParentImage|endswith:
    - \MR.exe
    - \DA.exe
  selection_parent_lanscope_path:
    ParentImage|contains: LANSCOPE
  selection_suspicious_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \regsvcs.exe
    - \rundll32.exe
    - \mshta.exe
  filter_legitimate_execution:
    CommandLine|contains:
    - /c dir
    - /c ipconfig
  condition: (selection_parent_lanscope or selection_parent_lanscope_path) and selection_suspicious_child
    and not filter_legitimate_execution
falsepositives:
- LANSCOPE diagnostic or remediation scripts invoked by the management server
- Legitimate endpoint management tasks executing system commands via LANSCOPE
level: high
id: 29ac42d9-2c8f-549d-8a06-4197320e9834
status: experimental
author: Vorant

LANSCOPE Endpoint Manager Process Memory Modification

ATT&CK T1210

Detects code injection or memory modification targeting LANSCOPE processes, consistent with in-memory exploitation of CVE-2025-61932. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: LANSCOPE Endpoint Manager Process Memory Modification
description: Detects suspicious memory access patterns on LANSCOPE Endpoint Manager
  processes (MR, DA). CVE-2025-61932 can be exploited to inject code; this rule identifies
  CreateRemoteThread, WriteProcessMemory, or VirtualAllocEx targeting LANSCOPE services.
tags:
- attack.t1210
- cve.2025.61932
logsource:
  category: image_load
  product: windows
detection:
  selection_lanscope_target:
    TargetImage|endswith:
    - \MR.exe
    - \DA.exe
  selection_lanscope_target_path:
    TargetImage|contains: LANSCOPE
  selection_injection:
    ImageLoaded|endswith:
    - \ntdll.dll
  selection_api:
    ApiName:
    - CreateRemoteThread
    - WriteProcessMemory
    - VirtualAllocEx
    - SetWindowsHookEx
  condition: (selection_lanscope_target or selection_lanscope_target_path) and selection_injection
    and selection_api
falsepositives:
- Legitimate LANSCOPE update or diagnostic tools performing process inspection
- Security software scanning LANSCOPE memory for threats
level: medium
id: 17da50aa-7f54-5777-91da-865c59e48f74
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2025/20251020-jvn.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free