Executive Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a directive for federal agencies to patch a critical, actively exploited vulnerability in Motex's LANSCOPE Endpoint Manager. The vulnerability, tracked as CVE-2025-61932, has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog due to evidence of in-the-wild attacks. The flaw, with a CVSS v4 score of 9.3, allows an unauthenticated, remote attacker to execute arbitrary code on systems running the LANSCOPE agent. Reports from Japan's JPCERT/CC and Motex confirm that attackers are targeting the flaw to deploy backdoors, prompting CISA to set a remediation deadline of November 12, 2025, for federal agencies.

Vulnerability Details

The vulnerability exists in the on-premises versions of LANSCOPE Endpoint Manager, specifically affecting the Client Program (MR) and Detection Agent (DA) components. It is described as an 'improper verification of source of a communication channel.' This allows a remote attacker on the same network segment to send specially crafted network packets to a listening port on an endpoint with the LANSCOPE agent installed. Successful exploitation results in the execution of arbitrary code with the privileges of the agent, which are typically elevated.

Affected Systems

The vulnerability affects the following on-premises products:

• LANSCOPE Endpoint Manager Client Program (MR): Versions 9.4.7.1 and earlier
• LANSCOPE Endpoint Manager Detection Agent (DA): Versions 9.4.7.1 and earlier

Motex has released several patched versions to address the issue, and customers are urged to upgrade.

Exploitation Status

Active exploitation has been confirmed, primarily in Japan. Japan's JPCERT/CC and the JVN portal reported that malicious packets targeting the vulnerability were observed in domestic customer environments starting after April 2025. Motex also confirmed at least one customer received a malicious packet suspected of exploiting this flaw. The goal of the observed attacks is to install an unspecified backdoor on the compromised endpoint, providing the attacker with persistent remote access (T1505.003 - Web Shell). The addition to the CISA KEV catalog on October 22, 2025, underscores the seriousness and ongoing nature of the threat.

Impact Assessment

Compromising an endpoint management solution like LANSCOPE provides a powerful foothold within a network.

• Privilege Escalation & Lateral Movement: An attacker can use the initial compromise to escalate privileges on the endpoint and move laterally to other systems in the network.
• Widespread Compromise: If the management server itself can be compromised from an endpoint, the attacker could potentially push malicious software to all managed devices.
• Data Theft and Espionage: The installed backdoor can be used to exfiltrate sensitive data or conduct long-term espionage.

Cyber Observables for Detection

Detection Methods

• Vulnerability Scanning: Use authenticated scans to identify endpoints running vulnerable versions of the LANSCOPE agent.
• Network Monitoring: Deploy network intrusion detection systems (NIDS) with signatures to detect the specific malicious packets used in the exploit.
• Endpoint Detection and Response (EDR): Use EDR to monitor the behavior of the LANSCOPE agent processes. Alert on any anomalous behavior, such as spawning shells, writing new executables to disk, or making outbound connections to unknown C2 servers.
• D3FEND Techniques: Employ D3-NTA: Network Traffic Analysis to spot the malicious packets and D3-PA: Process Analysis to detect anomalous agent behavior.

Remediation Steps

1. Patch Immediately: The primary remediation is to upgrade all LANSCOPE agents and management servers to the latest patched versions provided by Motex.
2. Network Segmentation: As a compensating control, limit network access to the ports used by the LANSCOPE agents. Ensure that only the management server can communicate with the agents on these ports and that endpoints cannot communicate with each other on them.
3. Threat Hunting: Proactively hunt for signs of compromise on systems running vulnerable versions, looking for suspicious files, processes, and network connections.
4. D3FEND Countermeasures:
   • The definitive fix is D3-SU: Software Update.
   • D3-ITF: Inbound Traffic Filtering on host-based firewalls can help restrict communication to the vulnerable agent ports.