JVN#89009783
Multiple vulnerabilities in WebSAM WinShare

Overview

WebSAM WinShare provided by NEC Corporation contains multiple vulnerabilities.

Products Affected

CVE-2026-113362

• WebSAM WinShare Ver 7.5.0 and earlier (excluding Ver 7.3.3)
• WebSAM WinShare Ver 7.6.0
• WebSAM WinShare Ver 7.7.0 to 7.7.1

• WebSAM WinShare Ver 7.2.0 to 7.5.0
• WebSAM WinShare Ver 7.6.0
• WebSAM WinShare Ver 7.7.0 to 7.7.2

• WebSAM WinShare Ver 7.5.0 and earlier
• WebSAM WinShare Ver 7.6.0
• WebSAM WinShare Ver 7.7.0 to 7.7.2

Description

WebSAM WinShare provided by NEC Corporation contains multiple vulnerabilities listed below.

• Incorrect default permissions in the program folder (CWE-276)
  • CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.5
  • CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score 7.8
  • CVE-2026-113362
• Exposed dangerous method or function (CWE-749)
  • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 9.3
  • CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score 9.8
  • CVE-2026-113363
• Heap-based buffer overflow (CWE-122)
  • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 9.3
  • CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score 9.8
  • CVE-2026-113364

Impact

• A non-administrative user on "Remote PC" may obtain SYSTEM privilege (CVE-2026-113362).
• If a specially crafted packet is sent to "Remote PC", an arbitrary command may be executed with SYSTEM privilege (CVE-2026-113363).
• If a specially crafted packet is sent to "Remote PC", arbitrary code may be executed with SYSTEM privilege (CVE-2026-113364).

Solution

Update the software
Update the software to the latest version according to the information provided by the developer.