{"id":"CVE-2026-109582","kind":"vulnerability","aliases":["CVE-2026-109582"],"related":[],"title":"SS1 by DOS Co., Ltd stores sensitive information insecurely, exposing it","description":"Insecure storage of sensitive information issue exists in SS1 provided by DOS Co., Ltd. Sensitive information used by the product may be obtained.","summary":"SS1, a product from DOS Co., Ltd, stores sensitive information insecurely. An attacker who can reach that stored data may be able to obtain the sensitive information the product uses.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dos-co-ltd","other","ss1"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T08:17:00+00:00","first_seen_at":"2026-11-09T08:25:21+00:00","triaged_at":"2026-11-09T08:25:54+00:00","updated_at":"2026-11-09T08:25:54+00:00","category":"other","confidence":0.3,"triage":{"at":"2026-11-09T08:25:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"SS1 by DOS Co., Ltd stores sensitive information insecurely, exposing it","impact":"medium","summary":"SS1, a product from DOS Co., Ltd, stores sensitive information insecurely. An attacker who can reach that stored data may be able to obtain the sensitive information the product uses.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ss1","dos-co-ltd"],"confidence":0.3,"fix_status":"unknown","needs_auth":"unknown","worst_case":"sensitive information used by the product is readable by an attacker","analyst_note":"Find the vendor advisory or JVN entry for SS1 by DOS Co., Ltd to confirm affected versions, access needed, and the fix.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000634,"input_tokens":4501,"output_tokens":367,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109582':13A,16A '-2026':12A,15A 'abl':44B 'attack':35B 'co':4A,19B,28B,65C 'cve':11A,14A 'data':41B 'dos':3A,18B,27B,64C 'dos-co-ltd':17B 'exist':59C 'expos':10A 'inform':8A,32B,49B,57C,68C 'insecur':9A,33B,53C 'issu':58C 'ltd':5A,20B,29B,66C 'may':42B,73C 'obtain':46B,75C 'product':25B,51B,72C 'provid':62C 'reach':38B 'sensit':7A,31B,48B,56C,67C 'ss1':1A,22B,23B,61C 'storag':54C 'store':6A,30B,40B 'use':52B,69C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["doscoltd","medium","other","ss1"],"campaign_type":null,"search_a":"'-109582':13A,16A '-2026':12A,15A 'co':4A 'cve':11A,14A 'dos':3A 'expos':10A 'inform':8A 'insecur':9A 'ltd':5A 'sensit':7A 'ss1':1A 'store':6A","search_b":"'abl':44B 'attack':35B 'co':19B,28B 'data':41B 'dos':18B,27B 'dos-co-ltd':17B 'inform':32B,49B 'insecur':33B 'ltd':20B,29B 'may':42B 'obtain':46B 'product':25B,51B 'reach':38B 'sensit':31B,48B 'ss1':22B,23B 'store':30B,40B 'use':52B","search_c":"'co':65C 'dos':64C 'exist':59C 'inform':57C,68C 'insecur':53C 'issu':58C 'ltd':66C 'may':73C 'obtain':75C 'product':72C 'provid':62C 'sensit':56C,67C 'ss1':61C 'storag':54C 'use':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T08:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vultures@jpcert.or.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109582","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109582","severity":null,"published_at":"2026-11-09T08:17:00+00:00","modified_at":"2026-11-09T08:17:00+00:00","first_seen_at":"2026-11-09T08:25:21+00:00","fetched_at":"2026-11-09T08:25:21+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}