CVE-2026-25785

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25785", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2026-02-16T01:44:58.906Z", "datePublished": "2026-02-25T06:01:05.327Z", "dateUpdated": "2026-02-25T21:15:15.207Z"}, "containers": {"cna": {"affected": [{"vendor": "MOTEX Inc.", "product": "Lanscope Endpoint Manager (On-Premises) Sub-Manager Server", "versions": [{"version": "Ver.9.4.7.3 and earlier", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Path traversal vulnerability exists in Lanscope Endpoint Manager (On-Premises) Sub-Manager Server Ver.9.4.7.3 and earlier, which may allow an attacker to tamper with arbitrary files and execute arbitrary code on the affected system."}], "problemTypes": [{"descriptions": [{"description": "Improper limitation of a pathname to a restricted directory ('Path Traversal')", "lang": "en-US", "cweId": "CWE-22", "type": "CWE"}]}], "references": [{"url": "https://www.motex.co.jp/news/notice/2026/release260225/"}, {"url": "https://jvn.jp/en/jp/JVN79096585/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-02-25T06:01:05.327Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T21:15:03.012255Z", "id": "CVE-2026-25785", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T21:15:15.207Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25785", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-25T21:15:03.012255Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T21:15:10.928Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "MOTEX Inc.", "product": "Lanscope Endpoint Manager (On-Premises) Sub-Manager Server", "versions": [{"status": "affected", "version": "Ver.9.4.7.3 and earlier"}]}], "references": [{"url": "https://www.motex.co.jp/news/notice/2026/release260225/"}, {"url": "https://jvn.jp/en/jp/JVN79096585/"}], "descriptions": [{"lang": "en", "value": "Path traversal vulnerability exists in Lanscope Endpoint Manager (On-Premises) Sub-Manager Server Ver.9.4.7.3 and earlier, which may allow an attacker to tamper with arbitrary files and execute arbitrary code on the affected system."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-22", "description": "Improper limitation of a pathname to a restricted directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-02-25T06:01:05.327Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25785", "state": "PUBLISHED", "dateUpdated": "2026-02-25T21:15:15.207Z", "dateReserved": "2026-02-16T01:44:58.906Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2026-02-25T06:01:05.327Z", "assignerShortName": "jpcert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Lanscope Endpoint Manager (On-Premises) Sub-Manager Server", "vendor": "MOTEX Inc.", "versions": [{"status": "affected", "version": "Ver.9.4.7.3 and earlier"}]}], "source": "vultures@jpcert.or.jp"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:motex:lanscope_endpoint_manager:*:*:*:*:on-premise:*:*:*", "matchCriteriaId": "5B926F03-56E5-4158-ADDA-13A8F580472C", "versionEndExcluding": "9.4.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Path traversal vulnerability exists in Lanscope Endpoint Manager (On-Premises) Sub-Manager Server Ver.9.4.7.3 and earlier, which may allow an attacker to tamper with arbitrary files and execute arbitrary code on the affected system."}, {"lang": "es", "value": "Vulnerabilidad de salto de ruta existe en Lanscope Endpoint Manager (On-Premises) Sub-Manager Server Ver.9.4.7.3 y anteriores, lo que podr\u00eda permitir a un atacante manipular archivos arbitrarios y ejecutar c\u00f3digo arbitrario en el sistema afectado."}], "id": "CVE-2026-25785", "lastModified": "2026-06-17T10:25:13.567", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25785", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T21:15:03.012255Z", "version": "2.0.3"}}]}, "published": "2026-02-25T06:16:25.123", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN79096585/"}, {"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://www.motex.co.jp/news/notice/2026/release260225/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "vultures@jpcert.or.jp", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,9.4.7.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Lanscope Endpoint Manager (On-Premises) Sub-Manager Server", "source": "cna", "vendor": "MOTEX Inc."}, "product": "lanscope_endpoint_manager", "vendor": "motex"}], "analysis": {"en": {"generated_at": "2026-04-18T10:47:03.186028+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2011issued patch that upgrades LANscope Endpoint Manager to a version newer than 9.4.7.3.", "If an update cannot be performed immediately, isolate the Sub\u2011Manager Server by allowing inbound traffic only from trusted IP addresses and disabling external administrative access.", "Ensure the web server applies strict path validation before any file write operations, preventing directory traversal and unauthorized file manipulation."], "summary": {"action": "Immediate patch", "impact": "Remote code execution"}, "threat_synthesis": {"affected_systems": "Motex Inc. offers the Lanscope Endpoint Manager (On\u2011Premises) Sub\u2011Manager Server. Versions up to and including 9.4.7.3 are vulnerable. No extension of the affected range is mentioned in the current data.", "description_and_impact": "The Lanscope Endpoint Manager (On\u2011Premises) Sub\u2011Manager Server version 9.4.7.3 and earlier contains a path traversal flaw that allows an attacker to manipulate arbitrary files on the server and subsequently execute arbitrary code. This weakness, identified as CWE\u201122, can undermine the confidentiality, integrity, and availability of the system by enabling a malicious actor to replace critical configuration or application files and run code with the server\u2019s privileges.", "risk_and_exploitability": "Based on the description, it is inferred that an attacker who can send requests to the Sub\u2011Manager Server\u2019s HTTP interface may construct a specially crafted request that bypasses path restrictions, directing the server to overwrite system files or drop scripts that are later executed. With a CVSS score of 9.3, the vulnerability is considered critical, but the EPSS score of less than 1% indicates that active exploitation is currently rare. The vulnerability is not listed in the CISA KEV catalog, so there is no known active exploit campaign, yet the high impact mandates prompt action."}}}}, "created": "2026-02-25T11:34:29.265235+00:00", "title": "Path traversal in Lanscope Endpoint Manager allows arbitrary file tampering and code execution", "updated": "2026-04-18T11:00:05.730979+00:00", "vendors": ["motex", "motex$PRODUCT$lanscope_endpoint_manager"]}