LANSCOPE Endpoint Manager RCE flaw exploited
A critical CVE-2025-61932 flaw in MOTEX LANSCOPE Endpoint Manager (on-premise) lets attackers achieve remote code execution via crafted packets, with real-world exploitation confirmed.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2025-61932 as exploited in the wild.
IPA/JVN issued an advisory for CVE-2025-61932, a critical vulnerability (CVSS v3 9.8) in MOTEX's LANSCOPE Endpoint Manager on-premise edition, affecting the client program (MR) and detection agent (DA) in versions 9.4.7.1 and earlier. The flaw stems from insufficient source validation of the product's communication channel, allowing an attacker who sends specially crafted packets to execute arbitrary code on the affected system.
The vendor has confirmed that malicious packets originating from external sources have already been observed hitting customer environments, indicating active exploitation attempts in the wild rather than a purely theoretical risk. The cloud version of LANSCOPE Endpoint Manager is not affected. Organizations running the on-premise version are urged to update to the patched release or apply the vendor's workaround immediately, given the endpoint management tool's typically privileged position within enterprise networks.
Mentioned in this report
Detection guidance
LANSCOPE Endpoint Manager Suspicious Network Communication
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects network connections from LANSCOPE client/agent processes (MR.exe, DA.exe) to unexpected remote hosts, indicating potential exploitation of CVE-2025-61932. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: LANSCOPE Endpoint Manager Suspicious Network Communication
description: Detects LANSCOPE Endpoint Manager client (MR) or detection agent (DA)
processes initiating unexpected outbound network connections. CVE-2025-61932 allows
remote code execution via specially crafted packets; this rule triggers on anomalous
network communication from affected processes that may indicate exploitation.
tags:
- attack.t1210
- cve.2025.61932
logsource:
category: network_connection
product: windows
detection:
selection_lanscope_process:
Image|endswith:
- \MR.exe
- \DA.exe
selection_lanscope_path:
Image|contains: LANSCOPE
selection_outbound:
Initiated: 'true'
filter_local_subnet:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
filter_lanscope_server:
DestinationHostname|contains: lanscope
condition: (selection_lanscope_process or selection_lanscope_path) and selection_outbound
and not (filter_local_subnet or filter_lanscope_server)
falsepositives:
- Legitimate LANSCOPE communication to internal management servers with non-standard
hostnames
- Misconfigured LANSCOPE deployments routing through external proxies
level: high
id: ded0d830-8302-5da3-818d-cd55da9dded9
status: experimental
author: Vorant
LANSCOPE Endpoint Manager Unexpected Child Process Creation
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects LANSCOPE client/agent processes spawning unexpected child processes, indicative of post-exploitation code execution from CVE-2025-61932. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: LANSCOPE Endpoint Manager Unexpected Child Process Creation
description: Detects LANSCOPE Endpoint Manager processes (MR.exe, DA.exe) spawning
suspicious child processes. CVE-2025-61932 allows arbitrary code execution; this
rule identifies process creation from affected services that may indicate successful
exploitation.
tags:
- attack.t1210
- cve.2025.61932
logsource:
category: process_creation
product: windows
detection:
selection_parent_lanscope:
ParentImage|endswith:
- \MR.exe
- \DA.exe
selection_parent_lanscope_path:
ParentImage|contains: LANSCOPE
selection_suspicious_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \regsvcs.exe
- \rundll32.exe
- \mshta.exe
filter_legitimate_execution:
CommandLine|contains:
- /c dir
- /c ipconfig
condition: (selection_parent_lanscope or selection_parent_lanscope_path) and selection_suspicious_child
and not filter_legitimate_execution
falsepositives:
- LANSCOPE diagnostic or remediation scripts invoked by the management server
- Legitimate endpoint management tasks executing system commands via LANSCOPE
level: high
id: 29ac42d9-2c8f-549d-8a06-4197320e9834
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2025/20251020-jvn.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs