CVE-2025-46409: DOS SS1 · Inadequate Encryption Strength
Affects DOS SS1Source CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 26 Oct 2026, 08:30 UTC
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 28 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
European organizations should immediately identify all instances of SS1 version 16.0.0.10 and earlier within their environment. Given the lack of publicly available patches, mitigation should focus on compensating controls: 1) Restrict network access to SS1 systems by implementing strict firewall rules and network segmentation to limit exposure to untrusted networks. 2) Employ intrusion detection and prevention systems (IDS/IPS) to monitor and block suspicious activities targeting SS1. 3) Enforce strong authentication and access controls at the network perimeter to reduce the attack surface. 4) Monitor logs and alerts for unusual access patterns or authentication bypass attempts. 5) Engage with DOS Co., Ltd. for information on forthcoming patches or updates and plan for timely application once available. 6) Consider temporary disabling or isolating vulnerable SS1 instances if feasible until a patch is deployed. 7) Conduct security awareness training for administrators managing SS1 to recognize and respond to potential exploitation attempts.
Description
Inadequate encryption strength issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). If this vulnerability is exploited, a function that requires authentication may be accessed by a remote unauthenticated attacker.