CVE-2025-53970 Details
Description
SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to upload arbitrary files and execute OS commands with SYSTEM privileges.
A vulnerability in SS1 versions through 16.0.0.10 (Media version through 16.0.0a) allows remote unauthenticated attackers to upload arbitrary files and execute operating system commands with SYSTEM privileges. This issue is present in both the standard SS1 application and SS1 Cloud versions through 2.1.3.
Users are advised to update to the latest version of SS1 or SS1 Cloud. Instructions for applying the update are available on the DOS Co., Ltd. website or through the SS1 Cloud admin panel.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 28, 2025CISA-ADP
Assessed Aug 28, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://jvn.jp/en/jp/JVN99577552/ | [email protected] | AdvisoryBundleRemedy |
| https://www.dos-osaka.co.jp/news/2025/08/250827.html | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| DOS Co., Ltd. SS1 | <= 16.0.0.10 <= 16.0.0a |
CPE
Remediation
| |
| DOS Co., Ltd. SS1 Cloud | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 28, 2025 | New CVE Received | [email protected] |