Lanscope Endpoint Manager CVE-2025-61932

Applies specifically to the On-Premises edition of Lanscope Endpoint Manager - the affected components are the Client program (MR) and the Detection agent (DA), so a vulnerable MR or DA instance must be installed and its request-handling service reachable from the attacker. The core condition is that these components improperly verify the origin of incoming requests, so an attacker only needs to send specially crafted packets to the listening component; per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are required. Limiting factors that reduce real-world exposure: the attacker must have network reachability to the MR/DA listener (typically the internal management network rather than the public internet), and only the on-premises product is in scope - cloud/SaaS editions are not implicated by the CPE strings.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-risk case. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, base 9.3) describes unauthenticated, network-reachable, low-complexity remote code execution with full confidentiality, integrity, and availability impact on the vulnerable system - the worst-case profile for an exploitability standpoint. The input includes a CISA Known Exploited Vulnerabilities catalog reference filtered to this exact CVE, indicating KEV listing and therefore confirmed active exploitation in the real world, which decisively elevates priority regardless of any statistical model. Note the signal limits: no EPSS probability score and no explicit POC flag were supplied in the input, so exploitation-probability modeling and public exploit-code status cannot be independently confirmed here - but KEV status makes those secondary, since confirmed exploitation outweighs a predictive EPSS value. CWE-940 (Improper Verification of Source of a Communication Channel) is consistent with the description's 'improperly verifies the origin of incoming requests,' corroborating the attack-vector claim. The one caveat defenders should verify: the CVSS asserts AV:N, and because the affected components are an endpoint client (MR) and detection agent (DA), real-world reachability depends on whether those listening services are exposed beyond the management segment - confirm network exposure with the vendor/JPCERT advisory.

An attacker with network reachability to a host running the Lanscope Endpoint Manager Client program (MR) or Detection agent (DA) sends specially crafted packets that the component fails to validate for proper origin. Because the request origin is not verified, the attacker's packets are accepted and processed, leading to arbitrary code execution on the endpoint without authentication or user interaction. This vulnerability is listed in the CISA KEV catalog per the provided reference, indicating it has been exploited in real-world attacks; independent public POC/exploit-code availability was not provided in the input.