CVE-2026-113363 Improper Input Validation in the network communication processing in NEC Corporation WebSAM WinShare Ver 7.2.0 through 7.5.0, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthent...

CriticalCVSS 9.3

Published: 2026-11-09 06:12
Updated: 2026-11-10 16:10
Exploit status: No public exploit known

Description

Improper Input Validation in the network communication processing in NEC Corporation WebSAM WinShare Ver 7.2.0 through 7.5.0, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary commands with SYSTEM privileges via a crafted network packet sent to the computer on which WinShare is running.

Affected products

Product	Affected versions	Fixed in
nec WebSAM WinShare	= Ver 7.2.0 through 7.5.0, Ver 7.6.0 and Ver 7.7.0 through 7.7.2	No fix listed

References

jpn.nec.com

CVSS v4.0

9.3 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None

Weakness & likelihood

EPSS (exploitation probability, 30 days): Not available
CWE: CWE-749 Exposed dangerous method or function

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.