CVE-2025-61932

criticalpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.028 · 86 %ileEUJPRUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV

Likely / severe?

2.77% (86th) EPSS

CVSS 9.8 · critical

Is it mine?

21 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

added 2025-10-22remediate by 2025-11-12

required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-26

Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability

Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets.

01

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · vultures@jpcert.or.jpexploitability 3.9 · impact 5.9

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v4.09.3criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.09.3criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · vultures@jpcert.or.jp

v4.09.3criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

02

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-940USCWE-940US

04

affected products (21)

Products and version ranges known to be affected.

MOTEX Inc. Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA))≤ Ver.9.4.7.1 and earlierenisa_euvdEU
MOTEX Inc. LANSCOPE Endpoint Manager On-Premise Edition≤ 9.4.7.3fstec_bduRU
MOTEX Inc. LANSCOPE Endpoint Manager On-Premise Edition≤ 9.4.6.3fstec_bduRU
MOTEX Inc. LANSCOPE Endpoint Manager On-Premise Edition≤ 9.4.5.4fstec_bduRU
MOTEX Inc. LANSCOPE Endpoint Manager On-Premise Edition≤ 9.4.4.6fstec_bduRU
MOTEX Inc. LANSCOPE Endpoint Manager On-Premise Edition≤ 9.4.3.8fstec_bduRU
MOTEX Inc. LANSCOPE Endpoint Manager On-Premise Edition≤ 9.4.2.6fstec_bduRU
MOTEX Inc. LANSCOPE Endpoint Manager On-Premise Edition≤ 9.4.1.5fstec_bduRU
MOTEX Inc. LANSCOPE Endpoint Manager On-Premise Edition≤ 9.4.0.5fstec_bduRU
MOTEX Inc. LANSCOPE Endpoint Manager On-Premise Edition≤ 9.3.3.9fstec_bduRU
MOTEX Inc. LANSCOPE Endpoint Manager On-Premise Edition≤ 9.3.2.7fstec_bduRU
motex lanscope endpoint manager< 9.3.2.7nvdUScpe:2.3:a:motex:lanscope_endpoint_manager:*:*:*:*:*:*:*:*
motex lanscope endpoint manager9.3.3.0 → 9.3.3.9nvdUScpe:2.3:a:motex:lanscope_endpoint_manager:*:*:*:*:*:*:*:*
motex lanscope endpoint manager9.4.0.0 → 9.4.0.5nvdUScpe:2.3:a:motex:lanscope_endpoint_manager:*:*:*:*:*:*:*:*
motex lanscope endpoint manager9.4.1.0 → 9.4.1.5nvdUScpe:2.3:a:motex:lanscope_endpoint_manager:*:*:*:*:*:*:*:*
motex lanscope endpoint manager9.4.2.0 → 9.4.2.6nvdUScpe:2.3:a:motex:lanscope_endpoint_manager:*:*:*:*:*:*:*:*
motex lanscope endpoint manager9.4.3.0 → 9.4.3.8nvdUScpe:2.3:a:motex:lanscope_endpoint_manager:*:*:*:*:*:*:*:*
motex lanscope endpoint manager9.4.4.0 → 9.4.4.6nvdUScpe:2.3:a:motex:lanscope_endpoint_manager:*:*:*:*:*:*:*:*
motex lanscope endpoint manager9.4.5.0 → 9.4.5.4nvdUScpe:2.3:a:motex:lanscope_endpoint_manager:*:*:*:*:*:*:*:*
motex lanscope endpoint manager9.4.6.0 → 9.4.6.3nvdUScpe:2.3:a:motex:lanscope_endpoint_manager:*:*:*:*:*:*:*:*

showing 20 of 21

05

advisories (1)

Vendor and ecosystem advisories describing this.

JVNDB-2025-000088JVN iPedia advisory JVNDB-2025-0000882025-10-22vendor · jvndbJP

06

also known as (4)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd jvndb NVD CVE.org MITRE

published 2025-10-20modified 2026-06-17

08

references (7)

External citations — patches, advisories, analysis.

https://jvn.jp/en/jp/JVN86318557/cnnvd
https://www.motex.co.jp/news/notice/2025/release251020/cnnvd
https://jvn.jp/en/jp/JVN86318557/enisa_euvd
https://www.motex.co.jp/news/notice/2025/release251020/enisa_euvd
https://jvn.jp/en/jp/JVN86318557/Third Party Advisorynvd
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61932Third Party AdvisoryUS Government Resourcenvd
https://www.motex.co.jp/news/notice/2025/release251020/Vendor Advisorynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.