Lanscope Endpoint Manager Zero-Day Exploited in the Wild

Lanscope Endpoint Manager has a zero-day vulnerability that has been exploited in the wild, tracked as CVE-2025-61932 with a CVSS score of 9.8. Motex says the flaw is caused by improper verification of the source of a communication channel, enabling remote attackers to execute arbitrary code via crafted packets; the advisory notes unauthorized packets were received from outside in a customer environment.

The flaw affects on-premises Lanscope Endpoint Manager versions 9.4.7[.]1 and earlier, and patches were released for versions including 9.3.2.7, 9.3.3.9, 9.4.0.5, 9.4.1.5, 9.4.2.6, 9.4.3[.]8, 9.4.4[.]6, 9.4.5[.]4, 9.4.6[.]3, and 9.4.7[.]3; all client systems should be updated to a patch version, though upgrading the manager itself is not required.

According to CISA, the agency added CVE-2025-61932 to its Known Exploited Vulnerabilities list, and federal agencies must identify vulnerable deployments and patch within three weeks by 12 November under BOD 22-01. The issue is predominantly used in Asia, particularly in Japan, with JPCERT/CC noting awareness of possible attacks against domestic organisations.