CVE-2025-61932

Katalog CVE

CVSS 9.3 · Critical KEV · sudah dieksploitasi EPSS 2,8%

Kerentanan Improper Verification of Source of a Communication Channel pada motex lanscope endpoint manager. Skor CVSS 4.0 9.3 (Critical) menurut jpcert.or.jp. Masuk katalog KEV CISA pada 22 Oktober 2025, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets.

Rincian

Terbit di NVD

20 Oktober 2025

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 4.0

9.3 (Critical), sumber jpcert.or.jp
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-940: Improper Verification of Source of a Communication Channel

EPSS (30 hari)

2,8% peluang dieksploitasi; lebih tinggi dari 85,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability

Masuk KEV

22 Oktober 2025

Tenggat CISA

12 November 2025 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.motex.co.jp/news/notice/2025/release251020/ advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61932 advisory pihak ketiga · pemerintah AS
• https://jvn.jp/en/jp/JVN86318557/ advisory pihak ketiga