The Cyber Security Agency of Singapore has assigned CVE-2026-55977 to a vulnerability in EShare's wireless screen mirroring and collaboration application. The flaw allows attackers with local network access to bypass the application's rate-limiting mechanism, enabling them to brute-force screen-sharing codes and display harmful content on affected screens. EShare has released a security update to address the vulnerability.
The vulnerability affects EShare Smart-TV Screensharing App versions through 7.6.0707. The Common Vulnerability Scoring System rates this flaw at 3.3 out of 10, indicating low severity. However, successful exploitation could disrupt normal application usage and allow unauthorized content display on screens using the affected software.
Attackers must have local network access to exploit this vulnerability. Once on the network, they can circumvent the rate-limiting controls designed to prevent repeated authentication attempts. This bypass enables brute-force attacks against the screen-sharing code, which could grant unauthorized access to display capabilities. The attack vector requires proximity to the target network, limiting remote exploitation possibilities.
Organizations using EShare's screen mirroring application on smart TVs face potential disruption to presentations and collaboration sessions. Malicious actors could interrupt business operations by displaying inappropriate or harmful content during meetings. The low CVSS score suggests limited impact, but the disruption potential in professional environments remains a concern for affected users.
Users and administrators should update to the latest version immediately by downloading the update file from EShare's website and following the installation process. To verify if a smart TV runs an affected version, locate the EShare application in the installed applications list on the TV's home screen or settings menu, then check the version details under application information. The specific steps vary by smart TV brand and model. The vulnerability was reported by James O'Connor.
Source: https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-093/