JVN#86318557    
Critical Lanscope Endpoint Manager (On-Premises) vulnerable to improper verification of source of a communication channel

Lanscope Endpoint Manager (On-Premises) provided by MOTEX Inc. contains a vulnreability that leads to arbitrary code execution due to improper verification of source of a communication channel (CWE-940).

• Lanscope Endpoint Manager (On-Premises) Ver.9.4.7.1 and earlier
  • Client program (MR)
  • Detection agent (DA)

Lanscope Endpoint Manager (Cloud) is not affected by the vulnerability.

Lanscope Endpoint Manager (On-Premises) provided by MOTEX Inc. contains the following vulnerability.

• Improper verification of source of a communication channel (CWE-940)
  • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 9.3
  • CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score 9.8
  • CVE-2025-61932

MOTEX Inc. has confirmed the case that its customer received a malicious packet suspected to target this vulnerability.

A specially crafted packet sent by an attacker could cause arbitrary code execution in the affected products.

Update the Products
Update the products to the fixed version.

Apply the Workaround
The developer recommends that users apply the workaround until the products are updated.

For more details, refer to the information provided by the developer.

Vendor	Link
MOTEX Inc.	[Important Notice] : Remote Code Execution Vulnerability in LANSCOPE Endpoint Manager (On-Premises) (CVE-2025-61932) (Text in Japanese)

1. JPCERT/CC CyberNewsFlash 2025-10-20
   Regarding a vulnerability (CVE-2025-61932) in Lanscope Endpoint Manager (On-Premises) to improper verification of source of a communication channel (Text in Japanese)

MOTEX Inc. reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and MOTEX Inc. coordinated under the Information Security Early Warning Partnership.