Incorrect Permission Assignment in SS1 Leading to Privilege Escalation
CVE-2025-53396

7.3HIGH

Key Information:

Vendor

Dos Co., Ltd.

Status
Ss1
Ss1 Cloud
Vendor
CVE Published:
28 August 2025

What is CVE-2025-53396?

A vulnerability has been identified in SS1 that involves incorrect permission assignments for critical resources. This issue affects SS1 version 16.0.0.10 and earlier, as well as Media version 16.0.0a and earlier. Attackers who gain access to a client terminal can exploit this vulnerability to obtain root privileges, potentially compromising the system’s security and integrity. It is essential for users of the affected products to review security protocols and take necessary precautions to mitigate the risk of unauthorized access.

Affected Version(s)

SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) (Affected under MacOS environment only)

SS1 Cloud Ver.2.1.3 and earlier (Affected under MacOS environment only)

References

https://www.dos-osaka.co.jp/news/2025/08/250827.html
https://jvn.jp/en/jp/JVN99577552/

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

CVSS V3.0

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-53396 : Incorrect Permission Assignment in SS1 Leading to Privilege Escalation