NetSetMan 4.7.1 contains a buffer overflow in the Workgroup feature that can be triggered by supplying an oversized configuration string. When an attacker creates a malicious file with excessive data and pastes it into the Workgroup field, the application crashes, resulting in a denial of service. The vulnerability is a classic stack‑based overflow (CWE‑787) that compromises the integrity of the application process.

The affected product is NetSetMan from Netsetman, specifically versions 4.0.0 through 4.7.1 running in the professional edition. The vulnerability is referenced by its CPE identifiers for each of those releases, and any user running the 4.x series, particularly 4.7.1, is susceptible. The 5.0.0 release is not listed as affected, implying it is not impacted.

With a CVSS score of 6.9, the risk is moderate but the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalogs, so it is not a widely known, actively exploited flaw. The local attacker must have access to the target system to supply the configuration file, so the likelihood of remote exploitation is low; however, any local user could easily trigger a denial of service.