CVE-2025-61932

What it actually does

CVE-2025-61932 is a remote code execution vulnerability in Lanscope Endpoint Manager On-Premises client components, specifically the Client program (MR) and Detection agent (DA). The flaw is caused by improper verification of the origin of incoming communications, allowing a remote attacker to send specially crafted packets that are trusted by the affected component and cause arbitrary code execution. Successful exploitation can give the attacker code execution in the security context of the vulnerable Lanscope client or agent process, potentially enabling endpoint compromise, persistence, lateral movement, disabling of endpoint management functions, or deployment of additional payloads.

Why it matters to the business

Because the affected software is endpoint management tooling, compromise can undermine systems that organizations rely on to monitor and administer endpoints. An attacker who exploits this flaw may gain control of managed machines, disrupt endpoint operations, steal data, deploy malware, or move deeper into the network. The vulnerability is listed in CISA KEV, has reported active exploitation in the wild, and had a CISA remediation deadline of 2025-11-12, making it a high-priority operational risk even though the EPSS score is relatively low. Known exploitation activity associated with Tick further increases concern for organizations using affected Lanscope Endpoint Manager On-Premises deployments.

How an attack unfolds

An attacker first identifies systems running affected Lanscope Endpoint Manager On-Premises client components or reaches endpoints where the Client program (MR) or Detection agent (DA) is exposed to attacker-controlled network traffic. The attacker then sends crafted packets that appear acceptable to the vulnerable component because the software does not properly verify the communication source. The component processes the malicious request and executes attacker-controlled code. After execution, the attacker can deploy follow-on tooling, establish persistence, collect host and network information, attempt credential access, disable or tamper with management/security functions, and move laterally to additional systems. Public reporting indicates active exploitation in the wild, including activity associated with Tick targeting this vulnerability.

How to fix it

Upgrade Lanscope Endpoint Manager On-Premises Client program (MR) and Detection agent (DA) to vendor-fixed versions as soon as available from Motex/Lanscope advisories. Because no exact fixed version was provided in the input, verify the applicable patched release directly with the vendor and confirm all managed endpoints receive the updated client and agent packages. If immediate patching is not possible, restrict network access to Lanscope client/agent communication channels to trusted management infrastructure only, block unsolicited inbound traffic to affected endpoints, segment endpoint management traffic, and monitor for unexpected connections to Lanscope components. Remove unsupported or unused Lanscope components, and ensure endpoint protection controls prevent unauthorized child processes, script execution, and payload staging from the Lanscope agent context.

How to confirm the fix worked

Confirm remediation by inventorying all systems with Lanscope Endpoint Manager On-Premises Client program (MR) and Detection agent (DA), verifying installed component versions against the vendor’s fixed-version guidance, and checking that all managed endpoints have successfully received the patched client/agent update. Validate network exposure by confirming affected components are not reachable from untrusted networks and that only authorized management servers can communicate with them. Review vulnerability scanner, EDR, software inventory, and endpoint management reports for remaining vulnerable versions. Where possible, perform controlled validation using vendor-approved detection checks rather than exploit traffic, and confirm that segmentation or firewall rules block unauthorized packet sources.

Typical attack path

1. Discover or reach endpoints running affected Lanscope Endpoint Manager On-Premises Client program (MR) or Detection agent (DA).
2. Send specially crafted packets to the vulnerable component from an untrusted or spoofed communication source.
3. Abuse improper origin verification so the component accepts and processes the malicious request.
4. Achieve arbitrary code execution in the context of the Lanscope client or agent process.
5. Deploy payloads or commands for persistence, reconnaissance, credential access, defense evasion, or lateral movement.
6. Use the compromised endpoint as a foothold for broader network compromise or operational disruption.

How to detect it

To determine whether exploitation already occurred, review endpoint, EDR, network, and Lanscope-related logs from at least the period starting before public disclosure on 2025-10-20 through the present. Focus on hosts running affected Client program (MR) or Detection agent (DA) versions. Look for inbound connections to Lanscope client or agent communication services from unauthorized systems, unusual packet sources, repeated malformed requests, or traffic from networks that should not communicate with endpoint management agents. On endpoints, hunt for suspicious process execution spawned by Lanscope client/agent processes, including command shells, scripting engines, file download utilities, archive tools, credential access tools, or unknown binaries. Review file system and persistence locations for newly created executables, services, scheduled tasks, startup items, or configuration changes occurring immediately after suspicious Lanscope network activity. Correlate with threat intelligence for Tick-associated infrastructure, malware, tools, and tactics where available. Because no universal exploit payload, port, process name, or file artifact is provided, detection should be behavior-based and environment-specific rather than relying solely on static IOCs.

What your security team should do

• Treat this as an urgent patching item because it is in CISA KEV, has active exploitation in the wild, and the CISA due date of 2025-11-12 has passed.
• Immediately inventory Lanscope Endpoint Manager On-Premises deployments and identify all endpoints running Client program (MR) or Detection agent (DA).
• Obtain the vendor advisory and deploy the fixed Lanscope client/agent versions across all affected endpoints.
• Restrict Lanscope client/agent communication so only trusted management servers can reach the relevant services.
• Hunt for prior exploitation on endpoints running affected versions, especially unexpected child processes, new persistence mechanisms, suspicious outbound connections, and activity around the Lanscope agent process context.
• Prioritize investigation for environments exposed to untrusted networks or with signs of activity associated with Tick or related campaigns.
• Add EDR/SIEM monitoring for anomalous process execution by Lanscope components and unexpected network sources communicating with Lanscope endpoint agents.
• If compromise is suspected, isolate affected hosts, collect forensic images and logs, rotate credentials that may have been exposed, and rebuild systems where integrity cannot be assured.