Skip to content
Log inStart free trial

CVE-2025-61932

Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an…

Critical Known exploited
Severity
9.3 / 10
Critical · CVSS 4.0
Exploit chance (EPSS)
2.77%
Chance of exploitation in the next 30 days. Higher than 86.31% of scored vulnerabilities.
Known exploited
Yes
In CISA's catalog since Oct 22, 2025
Weakness
CWE-940 Improper Verification of Source of a Communication Channel
Fix
None yet
No fixed version published
Exploited in the wild. Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability (Motex LANSCOPE Endpoint Manager). Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due for U.S. federal agencies by Nov 12, 2025.

Description

Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets.

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 4.0 9.3

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
None
User interaction
None
Confidentiality (vulnerable system)
High
Integrity (vulnerable system)
High
Availability (vulnerable system)
High
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None
Exploit maturity
Not defined
Scope
X

CVSS 3.0 9.8

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Weakness

CWE-940: Improper Verification of Source of a Communication Channel

The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.

How to prevent it
  • Architecture and Design: Use a mechanism that can validate the identity of the source, such as a certificate, and validate the integrity of data to ensure that it cannot be modified in transit using an Adversary-in-the-Middle (AITM) attack. When designing functionality of actions in the URL scheme, consider whether the action should be accessible to all mobile applications, or if an allowlist of applications to interface with is appropriate.

References

Advisories

Timeline

  1. Published
  2. Added to CISA's Known Exploited Vulnerabilities catalog
  3. Remediation due for U.S. federal agencies
  4. Last updated by the source
  5. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-hm92-r4w5-c3mj
undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
High Same weakness, CWE-940
GHSA-67c5-x5mf-rppq
MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution
Critical Same weakness, CWE-940
GHSA-5hgj-7gm9-cff5
AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address
Medium Same weakness, CWE-940
GHSA-cxmw-p77q-wchg
OpenClaw: Arbitrary code execution via unvalidated WebView JavascriptInterface
High Same weakness, CWE-940
GHSA-vh43-cc6x-prpr
usememos/memos vulnerable to Improper Verification of Source of a Communication Channel
Medium Same weakness, CWE-940
GHSA-mfvq-m3jj-8864
usememos/memos vulnerable to Improper Verification of Source of a Communication Channel
Medium Same weakness, CWE-940
GHSA-9hjv-9h75-xmpp
Improper Verification of Source of a Communication Channel in Apache Tomcat
Medium Same weakness, CWE-940
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor