U.S. CISA adds Motex LANSCOPE flaw to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a Motex LANSCOPE flaw to its Known Exploited Vulnerabilities catalog, tracked as CVE-2025-61932 with a CVSS v4 score of 9.3. The vulnerability concerns an improper verification of the source of a communication channel, which could allow an attacker to execute arbitrary code by sending specially crafted packets.

It affects the Lanscope Endpoint Manager on‑premises client and detection agent, enabling remote code execution due to improper request origin validation. Versions impacted are 9.4.7.1 and earlier, with fixes provided in versions 9.3.2.7, 9.3.3.9, 9.4.0.5, 9.4.1.5, 9.4.2.6, 9.4.3[.]8, 9.4.4[.]6, 9.4.5[.]4, 9.4.6[.]3, and 9.4.7[.]3.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, federal agencies must address the identified flaws by the due date to protect networks, with CISA ordering agencies to fix the vulnerabilities by 12 November 2025.