Kyocera Communications subsidiary Motex this week launched pressing patches for a critical-severity vulnerability in Lanscope Endpoint Supervisor that has been exploited within the wild as a zero-day.
Tracked as CVE-2025-61932 (CVSS rating of 9.8), the bug is described as “an improper verification of supply of a communication channel” challenge, which permits distant attackers to ship crafted packets and obtain arbitrary code execution.
In its advisory, Japan-based Motex warned that, in a buyer atmosphere, “unauthorized packets have been obtained from exterior”, hinting at an exploitation try.
There doesn’t look like any public data on the assaults exploiting CVE-2025-61932, however Japan’s JPCERT/CC mentioned it’s conscious of attainable assaults in opposition to home organizations. This isn’t stunning contemplating that the Lanscope endpoint administration product is primarily utilized in Asia, notably in Japan.
The flaw impacts on-premises Lanscope Endpoint Supervisor variations 9.4.7.1 and earlier, and was resolved with the discharge of variations 9.3.2.7, 9.3.3.9, 9.4.0.5, 9.4.1.5, 9.4.2.6, 9.4.3.8, 9.4.4.6, 9.4.5.4, 9.4.6.3, and 9.4.7.3.
All shopper methods needs to be up to date to a patch model, however the supervisor’s model improve shouldn’t be crucial, Motex mentioned.
On Wednesday, the US cybersecurity company CISA added CVE-2025-61932 to its Identified Exploited Vulnerabilities (KEV) listing, warning of its in-the-wild abuse.
As mandated by the Binding Operational Directive (BOD) 22-01, federal businesses ought to establish susceptible Lanscope Endpoint Supervisor deployments of their environments and patch them inside three weeks (by November 12).Commercial. Scroll to proceed studying.
“The sort of vulnerability is a frequent assault vector for malicious cyber actors and poses vital dangers to the federal enterprise,” CISA warned.
BOD 22-01 solely applies to federal businesses, however all organizations are suggested to evaluate CISA’s KEV listing and apply patches and mitigations for the vulnerabilities it describes.
Associated: CISA Warns of Exploited Apple, Kentico, Microsoft Vulnerabilities
Associated: CISA Confirms Exploitation of Newest Oracle EBS Vulnerability
Associated: Organizations Warned of Exploited Adobe AEM Types Vulnerability
Associated: Microsoft Patches 173 Vulnerabilities, Together with Exploited Home windows Flaws
