CVE-2026-113364

{
  "etk_id": "ETK-2026-3929",
  "cve_id": "CVE-2026-113364",
  "display_id": "CVE-2026-113364",
  "ghsa_id": "GHSA-9cm3-cgv8-62mc",
  "euvd_id": "EUVD-2026-119798",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated buffer overflow in WebSAM WinShare",
  "summary": "WebSAM WinShare on Windows is affected in versions 7.5.0 and earlier, 7.6.0, and 7.7.0 through 7.7.2. An unauthenticated remote attacker may execute code as SYSTEM by sending malformed protocol traffic to the data-receiving service. Exposure requires that an attacker can reach the affected service over the network.",
  "mitigation": "Restrict network access to the WebSAM WinShare data-receiving service to trusted hosts, such as by firewall allowlisting or network segmentation. Apply vendor-provided updates when available; the supplied advisory data does not identify a fixed version.",
  "vendor": "NEC Corporation",
  "product": "WebSAM WinShare",
  "affected": [
    {
      "affected_notes": [
        "Ver 7.5.0 and earlier",
        "Ver 7.6.0 and Ver 7.7.0 through 7.7.2"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "WebSAM WinShare",
      "purl": null
    }
  ],
  "cwes": [
    122
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0076,
  "epss_percentile": 0.5561,
  "epss_asof": "2026-11-09",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 7.923148183333334,
  "t0_at": "2026-11-09T04:14:03.038000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-10T07:26:19.116679+00:00",
      "days": 1.1335194291550925,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T04:14:03.038000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-09T04:14:03.038000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T04:14:03.038000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-113364"
    }
  }
}