Incident : Vulnerability

TAI1192311102125

Exposure Impact

Title: Critical Remote Code Execution Vulnerability in LANSCOPE Endpoint Manager (CVE-2025-61932)

Description: A critical remote code execution vulnerability (CVE-2025-61932) has been discovered in the on-premise edition of LANSCOPE Endpoint Manager, allowing unauthenticated attackers to run arbitrary commands with high privileges on affected systems. The flaw impacts both the Client Program (MR) and the Detection Agent (DA) in version 9.4.7.1 and earlier. Real-world exploit attempts have already been observed, making prompt patching imperative. The vulnerability is triggered by specially crafted network packets sent to computers running the vulnerable software, bypassing all user interaction requirements (no clicks or email openings needed). Evidence indicates malicious packets exploiting this weakness have been delivered to customer networks in live environments. Only the on-premise edition is affected; the Cloud Edition remains unaffected. A security update is now available, and administrators are advised to patch immediately and monitor networks for unusual incoming packets targeting these agents.

Type: Vulnerability

Attack Vector: Network-basedSpecially crafted packets

Vulnerability Exploited: Cve Id: CVE-2025-61932, Affected Product: LANSCOPE Endpoint Manager On-Premise Edition, Client Program (MR)Detection Agent (DA)9.4.7.1 and earlierCvss Score: {'version': '3.0', 'score': 9.8, 'severity': 'Critical'}, Publicly disclosedReal-world exploits observedUser Interaction Required: False, Privileges Required: None (unauthenticated), Impact: {'confidentiality': 'High', 'integrity': 'High', 'availability': 'High'}.

Incident : Vulnerability TAI1192311102125

Entity Name: Organizations using LANSCOPE Endpoint Manager On-Premise Edition

Entity Type: Enterprise, Government, SMB

Incident : Vulnerability TAI1192311102125

Containment Measures: Immediate patching of all on-premise endpointsNetwork monitoring for malicious packets targeting MR/DA agents

Remediation Measures: Apply security update from LANSCOPE support portalFollow standard software upgrade procedure for MR client and DA agent

Enhanced Monitoring: Monitor networks for unusual incoming packets targeting LANSCOPE agents

Incident : Vulnerability TAI1192311102125

Lessons Learned: Critical vulnerabilities in endpoint management software pose severe risks due to high privilege levels, On-premise solutions require immediate patching to prevent exploitation, Network monitoring is essential to detect exploitation attempts of client-side vulnerabilities

Incident : Vulnerability TAI1192311102125

Recommendations: Patch all on-premise LANSCOPE Endpoint Manager installations (MR and DA components) immediately using the provided security update, Monitor network traffic for malicious packets targeting LANSCOPE agents, especially on ports used by MR/DA components, Prioritize updates for systems with high-value data or critical operational roles, Review and update incident response plans to include rapid patching procedures for client-side endpoint management vulnerabilities, Consider network segmentation to limit lateral movement in case of exploitation, Evaluate the feasibility of migrating to the Cloud Edition, which is unaffected by this vulnerabilityPatch all on-premise LANSCOPE Endpoint Manager installations (MR and DA components) immediately using the provided security update, Monitor network traffic for malicious packets targeting LANSCOPE agents, especially on ports used by MR/DA components, Prioritize updates for systems with high-value data or critical operational roles, Review and update incident response plans to include rapid patching procedures for client-side endpoint management vulnerabilities, Consider network segmentation to limit lateral movement in case of exploitation, Evaluate the feasibility of migrating to the Cloud Edition, which is unaffected by this vulnerabilityPatch all on-premise LANSCOPE Endpoint Manager installations (MR and DA components) immediately using the provided security update, Monitor network traffic for malicious packets targeting LANSCOPE agents, especially on ports used by MR/DA components, Prioritize updates for systems with high-value data or critical operational roles, Review and update incident response plans to include rapid patching procedures for client-side endpoint management vulnerabilities, Consider network segmentation to limit lateral movement in case of exploitation, Evaluate the feasibility of migrating to the Cloud Edition, which is unaffected by this vulnerabilityPatch all on-premise LANSCOPE Endpoint Manager installations (MR and DA components) immediately using the provided security update, Monitor network traffic for malicious packets targeting LANSCOPE agents, especially on ports used by MR/DA components, Prioritize updates for systems with high-value data or critical operational roles, Review and update incident response plans to include rapid patching procedures for client-side endpoint management vulnerabilities, Consider network segmentation to limit lateral movement in case of exploitation, Evaluate the feasibility of migrating to the Cloud Edition, which is unaffected by this vulnerabilityPatch all on-premise LANSCOPE Endpoint Manager installations (MR and DA components) immediately using the provided security update, Monitor network traffic for malicious packets targeting LANSCOPE agents, especially on ports used by MR/DA components, Prioritize updates for systems with high-value data or critical operational roles, Review and update incident response plans to include rapid patching procedures for client-side endpoint management vulnerabilities, Consider network segmentation to limit lateral movement in case of exploitation, Evaluate the feasibility of migrating to the Cloud Edition, which is unaffected by this vulnerabilityPatch all on-premise LANSCOPE Endpoint Manager installations (MR and DA components) immediately using the provided security update, Monitor network traffic for malicious packets targeting LANSCOPE agents, especially on ports used by MR/DA components, Prioritize updates for systems with high-value data or critical operational roles, Review and update incident response plans to include rapid patching procedures for client-side endpoint management vulnerabilities, Consider network segmentation to limit lateral movement in case of exploitation, Evaluate the feasibility of migrating to the Cloud Edition, which is unaffected by this vulnerability

Incident : Vulnerability TAI1192311102125

Source: LANSCOPE Support Portal (Security Update)

Incident : Vulnerability TAI1192311102125

Source: CVE Details for CVE-2025-61932

Incident : Vulnerability TAI1192311102125

Investigation Status: Ongoing (real-world exploits observed; patch available)

Incident : Vulnerability TAI1192311102125

Stakeholder Advisories: Administrators Urged To Apply Patches Immediately, Network Teams Advised To Monitor For Exploitation Attempts.

Customer Advisories: Customers using on-premise LANSCOPE Endpoint Manager advised to contact their IT administrators to confirm patch applicationNo action required for Cloud Edition users

Incident : Vulnerability TAI1192311102125

Entry Point: Network Packets Targeting Vulnerable Mr/Da Agents,

Incident : Vulnerability TAI1192311102125

Root Causes: Vulnerability In Client-Side Software (Mr And Da Components) Allowing Unauthenticated Rce, Lack Of Input Validation For Network Packets,

Corrective Actions: Released Security Patch Addressing The Vulnerability, Advisory Issued For Immediate Patching And Network Monitoring,