Published:2026/11/09  Last Updated:2026/11/09

JVN#76179675
Multiple Vulnerabilities in SS1/ SS1 Cloud and the ODM product rocoeyes

Overview

SS1 and SS1 Cloud provided by DOS Co., Ltd. and the ODM product rocoeyes provided by Rococo Co. Ltd. contain multiple vulnerabilities.

Products Affected

DOS Co., Ltd.
CVE-2026-109582

  • SS1 Agent versions 17.0.0.50 and earlier (Media Versions 17.0.0e and earlier)
CVE-2026-113437
  • SS1 Agent versions 17.0.0.50 and earlier (Media Versions 17.0.0e and earlier)
  • SS1 Cloud Agent versions 3.2.0 and earlier
Rococo Co. Ltd.
CVE-2026-113437
  • rocoeyes Agent versions 3.1.1 and earlier

Description

IT asset management tool SS1 and SS1 Cloud provided by DOS Co., Ltd. and the ODM product rocoeyes provided by Rococo Co. Ltd. contain multiple vulnerabilities listed below.

  • Insecure Storage of Sensitive Information (CWE-922)
    • CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Base Score 5.1
    • CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Base Score 4.0
    • CVE-2026-109582
  • Path Traversal (CWE-22)
    • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Base Score 6.9
    • CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Base Score 5.3
    • CVE-2026-113437

Impact

  • Sensitive information used by the product may be obtained (CVE-2026-109582).
  • Arbitrary files may be deleted (CVE-2026-113437).

Solution

Update the software
Update software to the latest version according to the information provided by the developer.
The developer has released the following versions to fix the vulnerabilities:

DOS Co., Ltd.

  • SS1
    • Ver.17.1.0.10 (Media Version: 17.1.0a)
    • Ver.17.0.0.60 (Media Version: 17.0.0f)
    • Ver.16.1.0.100 (Media Version: 16.1.0j)
    • Ver.16.0.0.60 (Media Version: 16.0.0f)
    • Ver.15.1.0.70 (Media Version: 15.1.0g)
    • Ver.15.0.0.80 (Media Version: 15.0.0h)
    • Ver.14.1.0.90 (Media Version: 14.1.0i)
    • Ver.14.0.0.90 (Media Version: 14.0.0i)
    • Ver.13.1.0.100 (Media Version: 13.1.0j)
    • Ver.13.0.0.90 (Media Version: 13.0.0i)
  • SS1 Cloud
    • ver.3.1 series: Agent version: 3.1.1a
    • ver.3.2 series: Agent version: 3.2.0a
Rococo Co. Ltd.
  • rocoeyes Agent version: 3.1.1a

Vendor Status

Vendor Link
DOS Co., Ltd. Notification of Vulnerabilities in SS1 and SS1 Cloud (Text in Japanese)
Rococo Co. Ltd. Notification of Vulnerabilities in rocoeyes(Text in Japanese, PDF)

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

CVE-2026-109582
Murashima Masahiro of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

CVE-2026-113437
Christoph Senn reported this vulnerability to JPCERT/CC.
JPCERT/CC coordinated with the developer.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2026-109582
CVE-2026-113437
JVN iPedia