{"id":"CVE-2026-113364","kind":"vulnerability","aliases":["CVE-2026-113364"],"related":[],"title":"NEC WebSAM WinShare: unauthenticated packet overflow runs code as SYSTEM","description":"Buffer Overflow in the data receiving process in NEC Corporation WebSAM WinShare Ver 7.5.0 and earlier, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary code with SYSTEM privileges via a crafted packet with a malformed data size value in the protocol header.","summary":"NEC WebSAM WinShare on Windows has a buffer overflow in its data receiving process, triggered by a crafted packet with a malformed data size in the protocol header. A remote attacker with no login can run arbitrary code with SYSTEM privileges.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WebSAM WinShare","fixed":[],"affected":"<= 7.5.0, 7.6.0, >= 7.7.0, <= 7.7.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["nec-websam","vendor","windows","winshare"],"not_affected_if":["not-installed","unsupported-version-not-listed"],"how_to_check":"- Check whether WebSAM WinShare is installed on Windows hosts and note its version.\n- Confirm whether the affected versions `7.5.0` and earlier, `7.6.0`, or `7.7.0` through `7.7.2` are in use.\n- Check whether the WinShare data receiving port is reachable from untrusted networks.","fix":null,"status":"open","published_at":"2026-11-09T05:18:26+00:00","first_seen_at":"2026-11-09T05:25:20+00:00","triaged_at":"2026-11-09T05:26:52+00:00","updated_at":"2026-11-09T05:27:59+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-09T05:26:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"NEC WebSAM WinShare: unauthenticated packet overflow runs code as SYSTEM","impact":"high","summary":"NEC WebSAM WinShare on Windows has a buffer overflow in its data receiving process, triggered by a crafted packet with a malformed data size in the protocol header. A remote attacker with no login can run arbitrary code with SYSTEM privileges.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["windows","nec-websam","winshare"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker runs arbitrary code with SYSTEM privileges on Windows.","analyst_note":"Check NEC's advisory and JVN notice for the fixed version and whether the flaw is reachable from the internet; sources here give no fix or exposure detail.","how_to_check":"- Check whether WebSAM WinShare is installed on Windows hosts and note its version.\n- Confirm whether the affected versions `7.5.0` and earlier, `7.6.0`, or `7.7.0` through `7.7.2` are in use.\n- Check whether the WinShare data receiving port is reachable from untrusted networks.","plain_action":"","product_name":"WebSAM WinShare","needs_analyst":true,"not_affected_if":["not-installed","unsupported-version-not-listed"],"who_is_affected":"Organisations running NEC WebSAM WinShare on Windows, versions 7.5.0 and earlier, 7.6.0, and 7.7.0 through 7.7.2, are exposed. Any host where the data receiving service accepts network packets is in scope. Systems running other versions or without WinShare installed can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00079,"input_tokens":4608,"output_tokens":659,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check NEC's advisory and JVN notice for the fixed version and whether the flaw is reachable from the internet; sources here give no fix or exposure detail.","search":"'-113364':13A,16A '-2026':12A,15A '7.5.0':79C '7.6.0':83C '7.7.0':86C '7.7.2':88C 'allow':91C 'arbitrari':61B,98C 'attack':55B,95C 'buffer':32B,66C 'code':8A,62B,99C 'corpor':75C 'craft':42B,105C 'cve':11A,14A 'data':36B,47B,70C,110C 'earlier':81C 'execut':97C 'header':52B,116C 'login':58B 'malform':46B,109C 'nec':1A,20B,25B,74C 'nec-websam':19B 'overflow':6A,33B,67C 'packet':5A,43B,106C 'privileg':65B,102C 'process':38B,72C 'protocol':51B,115C 'receiv':37B,71C 'remot':54B,93C 'run':7A,60B 'size':48B,111C 'system':10A,64B,101C 'trigger':39B 'unauthent':4A,94C 'valu':112C 'vendor':22B 'ver':78C,82C,85C 'via':103C 'websam':2A,17A,21B,26B,76C 'window':23B,29B,90C 'winshar':3A,24B,27B,77C 'winshare':18A","nicknames":[],"mitigations":[],"who_affected":"Organisations running NEC WebSAM WinShare on Windows, versions 7.5.0 and earlier, 7.6.0, and 7.7.0 through 7.7.2, are exposed. Any host where the data receiving service accepts network packets is in scope. Systems running other versions or without WinShare installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["websamwinshare","winshare"],"ptokens":["websam","winshare"],"labels":["critical","necwebsam","vendor","windows","winshare"],"campaign_type":null,"search_a":"'-113364':13A,16A '-2026':12A,15A 'code':8A 'cve':11A,14A 'nec':1A 'overflow':6A 'packet':5A 'run':7A 'system':10A 'unauthent':4A 'websam':2A,17A 'winshar':3A 'winshare':18A","search_b":"'arbitrari':61B 'attack':55B 'buffer':32B 'code':62B 'craft':42B 'data':36B,47B 'header':52B 'login':58B 'malform':46B 'nec':20B,25B 'nec-websam':19B 'overflow':33B 'packet':43B 'privileg':65B 'process':38B 'protocol':51B 'receiv':37B 'remot':54B 'run':60B 'size':48B 'system':64B 'trigger':39B 'vendor':22B 'websam':21B,26B 'window':23B,29B 'winshar':24B,27B","search_c":"'7.5.0':79C '7.6.0':83C '7.7.0':86C '7.7.2':88C 'allow':91C 'arbitrari':98C 'attack':95C 'buffer':66C 'code':99C 'corpor':75C 'craft':105C 'data':70C,110C 'earlier':81C 'execut':97C 'header':116C 'malform':109C 'nec':74C 'overflow':67C 'packet':106C 'privileg':102C 'process':72C 'protocol':115C 'receiv':71C 'remot':93C 'size':111C 'system':101C 'unauthent':94C 'valu':112C 'ver':78C,82C,85C 'via':103C 'websam':76C 'window':90C 'winshar':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T05:18:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt-info@cyber.jp.nec.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113364","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113364","severity":null,"published_at":"2026-11-09T05:18:26+00:00","modified_at":"2026-11-09T05:18:26+00:00","first_seen_at":"2026-11-09T05:25:20+00:00","fetched_at":"2026-11-09T05:25:20+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113364:2245","url":null,"severity":null,"published_at":"2026-11-09T05:27:59+00:00","modified_at":"2026-11-09T05:27:59+00:00","first_seen_at":"2026-11-09T05:27:59+00:00","fetched_at":"2026-11-09T05:27:59+00:00","note":"Could not reach NEC advisory/JVN (web-cli out of Exa credits, NEC PSIRT 403, NVD page empty). Fixed version, ports and exposure unknown; nothing verified. Affected range is from the NVD description (CNA: NEC PSIRT). Settle by reading NEC security-info page or JVN for this CVE."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}