CVE-2025-61932
Published: 20 October 2025
Summary
CVE-2025-61932 is a uncategorised-severity Improper Verification of Source of a Communication Channel (CWE-940) vulnerability in Motex Lanscope Endpoint Manager. Its CVSS base score is N/A.
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 16.4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the improper origin verification flaw in Lanscope Endpoint Manager's Client program (MR) and Detection agent (DA) by applying vendor patches to prevent arbitrary code execution from crafted packets.
Enforces boundary protection to monitor and control network traffic, blocking unauthorized or specially crafted packets from reaching vulnerable instances of the Client program (MR) and Detection agent (DA).
Requires validation of incoming network requests to verify origin, directly countering the CWE-940 vulnerability that allows arbitrary code execution via unverified packets.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows remote arbitrary code execution via specially crafted network packets due to improper origin verification, directly enabling exploitation of a public-facing or network-accessible application.
NVD Description
Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets.
Deeper analysisAI
CVE-2025-61932 is a vulnerability in Lanscope Endpoint Manager (On-Premises), affecting the Client program (MR) and Detection agent (DA). It arises from improper verification of the origin of incoming requests, classified under CWE-940. This flaw allows an attacker to execute arbitrary code by sending specially crafted packets to the affected components.
An attacker with the ability to send network packets to vulnerable instances of the Client program (MR) or Detection agent (DA) can exploit this issue. Successful exploitation results in arbitrary code execution on the targeted systems, potentially compromising endpoint management functions.
Advisories published by JVN (https://jvn.jp/en/jp/JVN86318557/) and Motex (https://www.motex.co.jp/news/notice/2025/release251020/) detail the vulnerability and mitigation steps. The CVE is also listed in CISA's Known Exploited Vulnerabilities Catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61932), signaling real-world exploitation.
Details
- CWE(s)
- KEV Date Added
- 22 October 2025