CVE-2026-109582
Received Received - Intake

Insecure Storage of Sensitive Data in SS1

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: JPCERT/CC

Description
Insecure storage of sensitive information issue exists in SS1 provided by DOS Co., Ltd. Sensitive information used by the product may be obtained.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-109582
EUVD
EUVD-2026-119874

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
dos_co_ltd ss1 to 17.0.0.50 (exc)
dos_co_ltd ss1_cloud to 3.2.0 (exc)
rococo_co_ltd rocoeyes to 3.1.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-922 The product stores sensitive information without properly limiting read or write access by unauthorized actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves insecure storage of sensitive information in SS1 software by DOS Co., Ltd. Sensitive data used by the product could be accessed by unauthorized parties due to improper protection of stored information.

Impact Analysis

An attacker could exploit this to obtain sensitive information stored by the product, potentially leading to data breaches or unauthorized access to confidential data.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA by exposing sensitive personal or health information, resulting in legal penalties or reputational damage.

Mitigation Strategies

Update SS1 to versions 17.1.0.10, 17.0.0.60, 16.1.0.100, 16.0.0.60, 15.1.0.70, 15.0.0.80, 14.1.0.90, 14.0.0.90, 13.1.0.100, or 13.0.0.90. Update SS1 Cloud to versions 3.1.1a or 3.2.0a. Update rocoeyes to version 3.1.1a.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109582. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...