Lanscope Endpoint Manager (On-Premises) 子管理器服务器 Ver.9.4.7.3 及更早版本存在路径遍历漏洞，可能允许攻击者篡改任意文件并执行任意代码。

The path traversal vulnerability in Lanscope Endpoint Manager allows an attacker to bypass intended access controls and manipulate files on the server. Successful exploitation could lead to complete system compromise, including data exfiltration, malware installation, and denial of service. An attacker could potentially modify configuration files, inject malicious code into legitimate processes, or gain persistent access to the network. The ability to execute arbitrary code significantly expands the attack surface and increases the potential for lateral movement within the environment. This vulnerability shares similarities with other path traversal exploits where attackers leverage improperly validated user input to navigate outside of intended directories.

Organizations utilizing Lanscope Endpoint Manager (On-Premises) Sub-Manager Server, particularly those with legacy configurations or limited security controls, are at significant risk. Shared hosting environments where multiple users share the same server instance are also vulnerable, as a compromise of one user's account could potentially lead to the exploitation of this vulnerability.

• windows / other: Monitor event logs for unusual file access patterns, particularly attempts to access files outside of the expected Lanscope Endpoint Manager directory. Use Sysinternals Process Monitor to track file system activity and identify suspicious processes. • linux / server: Monitor system logs (e.g., /var/log/auth.log, /var/log/syslog) for unusual file access attempts. Use auditd to track file system access and create rules to detect suspicious patterns. • generic web: Monitor web server access logs for requests containing directory traversal sequences (e.g., ../../).

1. 2026-02-25Disclosure

   disclosure

1. 已保留2026-02-16
2. 发布日期2026-02-25
3. EPSS 更新日期2026-03-23

Due to the lack of a currently available patch, immediate mitigation strategies are crucial. Implement strict access controls to limit user privileges and restrict file system access. Consider using a Web Application Firewall (WAF) to filter requests and block attempts to traverse directories. Monitor system logs for suspicious activity, particularly attempts to access unusual file paths. While a direct fix is pending, carefully review Lanscope Endpoint Manager's configuration and ensure that all unnecessary services and ports are disabled. After a patch is released, promptly apply it and verify its effectiveness by attempting to reproduce the vulnerability in a test environment.