---
title: "LANSCOPE CVE-2025-61932: Agent RCE Exploited in Japan"
url: https://erroneo.us/security/briefs/lanscope-endpoint-manager-cve-2025-61932-agent-rce/
description: "LANSCOPE Endpoint Manager On-Premises agents 9.4.7.1 and earlier allowed SYSTEM-level RCE, exploited by BRONZE BUTLER. Patch every client; hunt for Gokcpdoor."
type: security-brief
section: "Security Digest"
date_published: 2025-10-20
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-61932"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# LANSCOPE CVE-2025-61932: Agent RCE Exploited in Japan

**Verdict: Check exposure.** A state-sponsored group used this as a zero-day from at least April 2025; a year after the fix, the job is confirming every endpoint agent was updated and hunting for the backdoors it left behind.

- **Who must act:** Organizations running LANSCOPE Endpoint Manager On-Premises, a Japanese product, especially where the client program or detection agent runs on internet-reachable servers or on PCs with public IP addresses.
- **Who can relax:** LANSCOPE Endpoint Manager Cloud customers, and anyone with no Motex LANSCOPE agents in their estate.
- **Affected:** LANSCOPE Endpoint Manager (On-Premises) client program (MR) Ver.9.4.7.1 and earlier; LANSCOPE Endpoint Manager (On-Premises) detection agent (DA) Ver.9.4.7.1 and earlier
- **Fixed:** MR and DA 9.3.2.7, 9.3.3.9, 9.4.0.5, 9.4.1.5, 9.4.2.6, 9.4.3.8, 9.4.4.6, 9.4.5.4, 9.4.6.3 or 9.4.7.3, depending on branch (Oct 20, 2025); Sub-Manager Server needs a version later than 9.4.7.3 for the separate CVE-2026-25785
- **CVEs:** CVE-2025-61932
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. List every endpoint running the LANSCOPE client program (MR) or detection agent (DA) and confirm each is on a fixed build for its branch; the manager server alone is not enough.
2. Update the On-Premises Sub-Manager Server past 9.4.7.3 for the February 2026 path traversal CVE-2026-25785.
3. Find agents on internet-reachable hosts, such as LANSCOPE servers, public Windows servers or SIM-equipped laptops with global IPs, and remove direct exposure.
4. Search logs for the JPCERT/CC and Sophos indicators below, going back to April 2025.
5. If you find a hit, treat it as an Active Directory compromise: isolate hosts, reset privileged credentials and review data that left through file-sharing services.

### How to check if you are affected

- Search firewall, proxy and EDR logs since April 2025 for 38.54.56[.]57 and 38.54.88[.]172 on TCP 443, and for inbound connections from 38.54.56[.]10, 38.60.212[.]85 and 108.61.161[.]118.
- Look for listeners on TCP 38000 or 38002, which Sophos saw opened by the Gokcpdoor backdoor.
- Hunt for oci.dll (Gokcpdoor), MaxxAudioMeters64LOC.dll (Havoc) and winupdate.exe (the goddi AD dumper) in unusual locations, plus browser access to file.io, LimeWire or Piping Server from servers.

## What happened

On October 20, 2025, Motex [warned customers](http://web.archive.org/web/20261007004922/https://www.motex.co.jp/news/notice/2025/release251020/) about CVE-2025-61932 in LANSCOPE Endpoint Manager On-Premises, a Japanese asset and endpoint management suite. The bug is in the client program (MR) and detection agent (DA) installed on managed PCs and servers. Per [JVN#86318557](https://jvn.jp/en/jp/JVN86318557/), the agents do not properly verify where incoming requests come from (CWE-940), so a crafted packet can run arbitrary code. JPCERT/CC, as CNA, scores it CVSS 3.0 9.8 and CVSS 4.0 9.3. Motex said customer environments had already received malicious packets from outside.

[JPCERT/CC](https://www.jpcert.or.jp/newsflash/2025102001.html) added that it knew of attack activity against Japanese organizations that suggests this bug was exploited, dating back to April 2025. It published five attacker IP addresses. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61932) on October 22, 2025, with a November 12 deadline. CISA's notes rate it automatable, with total technical impact.

[Sophos' Counter Threat Unit](https://www.sophos.com/blog/bronze-butler-exploits-japanese-asset-management-software-vulnerability) then attributed a mid-2025 campaign to BRONZE BUTLER, also called Tick, a Chinese state-sponsored group active since 2010. The same group used a zero-day in another Japanese asset management product, SKYSEA Client View, in 2016. Sophos says the bug gave SYSTEM-level command execution. The attackers deployed a new Gokcpdoor backdoor variant or the Havoc C2 framework, loaded through OAED Loader. They dumped Active Directory with goddi, moved over remote desktop through the backdoor tunnel, packed data with 7-Zip and visited file.io, LimeWire and Piping Server in a browser.

## Who is affected

MR and DA Ver.9.4.7.1 and earlier, per the [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-61932). Fixed builds exist for each branch, from 9.3.2.7 to 9.4.7.3. Motex says every client PC needs the update, not the manager server. The cloud edition is not affected. JPCERT/CC flags the highest-risk setups: agents on LANSCOPE servers placed on the internet, internet-facing Windows servers, and SIM-equipped PCs with global IP addresses.

## Do you really need to act?

If you run the On-Premises edition, yes, but as a check. Sophos judged the number of vulnerable internet-facing devices to be low. It warned that attackers already inside a network could use the agents for privilege escalation and lateral movement. An agent sits on nearly every managed endpoint, so one missed update group leaves a path. Neither Motex nor JPCERT/CC named the targeted port publicly.

A fixed agent is not the end of it. In February 2026, [JVN#79096585](https://jvn.jp/en/jp/JVN79096585/) disclosed CVE-2026-25785, a path traversal in the On-Premises Sub-Manager Server 9.4.7.3 and earlier, also scored 9.8. No exploitation of it had been reported as of Oct 23, 2026.

## What to do now

1. From the LANSCOPE console, list every MR and DA install and confirm each is on a fixed build for its branch.
2. Update the Sub-Manager Server past 9.4.7.3.
3. Remove direct internet exposure from any host running an agent.
4. Run the hunts below, going back to April 2025.

## How to tell if you were hit

- Search firewall and proxy logs for `38.54.56[.]57` and `38.54.88[.]172` on TCP 443, and for `38.54.56[.]10`, `38.60.212[.]85` and `108.61.161[.]118`.
- On Windows hosts, run `Get-NetTCPConnection -State Listen | Where-Object LocalPort -in 38000,38002`. Sophos saw Gokcpdoor listen on those ports.
- Hunt for `oci.dll`, `MaxxAudioMeters64LOC.dll` and `winupdate.exe` outside their normal locations. Sophos lists hashes for each.

## Timeline

- Apr 2025 — Start of attack activity, per JPCERT/CC.
- Oct 20, 2025 — Motex, JVN and JPCERT/CC disclose the bug and fixed builds.
- Oct 22, 2025 — CISA adds CVE-2025-61932 to KEV.
- Nov 1, 2025 — [BleepingComputer](https://www.bleepingcomputer.com/news/security/china-linked-hackers-exploited-lanscope-flaw-as-a-zero-day-in-attacks/) reports Sophos' BRONZE BUTLER attribution.
- Feb 25, 2026 — JVN discloses CVE-2026-25785 in the Sub-Manager Server.

## Sources

1. [Motex — Important notice: remote code execution vulnerability in LANSCOPE Endpoint Manager On-Premises (CVE-2025-61932), Japanese (archived Oct 7, 2026)](http://web.archive.org/web/20261007004922/https://www.motex.co.jp/news/notice/2025/release251020/)
2. [JVN — JVN#86318557: Lanscope Endpoint Manager (On-Premises) vulnerable to improper verification of source of a communication channel](https://jvn.jp/en/jp/JVN86318557/)
3. [JPCERT/CC — CyberNewsFlash on CVE-2025-61932 (Japanese)](https://www.jpcert.or.jp/newsflash/2025102001.html)
4. [CVE record — CVE-2025-61932](https://www.cve.org/CVERecord?id=CVE-2025-61932)
5. [NVD — CVE-2025-61932](https://nvd.nist.gov/vuln/detail/CVE-2025-61932)
6. [CISA — Known Exploited Vulnerabilities: CVE-2025-61932](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61932)
7. [Sophos Counter Threat Unit — BRONZE BUTLER exploits Japanese asset management software vulnerability](https://www.sophos.com/blog/bronze-butler-exploits-japanese-asset-management-software-vulnerability)
8. [JVN — JVN#79096585: Lanscope Endpoint Manager (On-Premises) vulnerable to path traversal (CVE-2026-25785)](https://jvn.jp/en/jp/JVN79096585/)
9. [BleepingComputer — China-linked hackers exploited Lanscope flaw as a zero-day in attacks](https://www.bleepingcomputer.com/news/security/china-linked-hackers-exploited-lanscope-flaw-as-a-zero-day-in-attacks/)

---
Source page: https://erroneo.us/security/briefs/lanscope-endpoint-manager-cve-2025-61932-agent-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt