NEC WebSAM WinShare Access and Memory Corruption Flaws

Remote, unauthenticated command execution as SYSTEM is possible against NEC WebSAM WinShare on Windows - versions 7.2.0 through 7.5.0, 7.6.0, and 7.7.0 through 7.7.2 - because the product's network communication processing fails to properly validate input. An attacker who can reach the WinShare listening port needs only to send a crafted network packet; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms no credentials, no user interaction, and no special preconditions beyond network reachability, yielding full compromise of confidentiality, integrity and availability. vuln.today's priority decision is act_now, reflecting a genuine top-priority case rather than a high-score/low-risk artifact; no CISA KEV entry or public exploit code is identified in the available sources, and the practical risk is dominated by whether the service port is exposed to untrusted networks.

Remote code execution in NEC WebSAM WinShare on Windows lets an unauthenticated network attacker run arbitrary code with SYSTEM privileges on hosts running Ver 7.5.0 and earlier, Ver 7.6.0, or Ver 7.7.0 through 7.7.2. A single crafted packet carrying a malformed data-size value in the protocol header overflows a heap buffer in the data-receiving process (CWE-122), giving full control of the host at the highest Windows privilege level. Scored 9.3 (CVSS 4.0) and rated act_now; no public exploit identified at time of analysis, and the practical limiting factor is exposure - the data-receiving service must be network-reachable, so firewalled or non-internet-facing deployments and the product's limited deployment footprint constrain the realistic target set.

Local privilege escalation in NEC WebSAM Winshare on Windows lets an authenticated low-privileged user gain SYSTEM-level code execution by placing a crafted DLL in the product's installation folder, where a SYSTEM-level process loads it. Affected builds are Ver 7.5.0 and earlier excluding Ver 7.3.3, Ver 7.6.0, and Ver 7.7.0 through Ver 7.7.1; exploitation requires existing local access and low-privilege credentials. No public exploit was identified at time of analysis, and the local vector makes this a credible host-level privilege-escalation issue rather than a remotely wormable emergency.