The vulnerability lies in the insecure storage of sensitive information within SS1, enabling an attacker to obtain that data. This results in a disclosure of confidential data, thus compromising the confidentiality of the information handled by the product. The weakness corresponds to CWE‑922, which involves inadequate protection of sensitive data. The impact is a potential loss of confidentiality for anyone whose data is stored or processed by SS1.

The affected system is SS1 from DOS Co., Ltd. No specific version numbers are supplied in the data; therefore all released versions of SS1 may be impacted until a fix is available. Users should verify whether their deployed version contains the insecure storage issue and consider upgrading if a patch is released.

The CVSS score is 5.1, indicating a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting the exploitation risk is not currently known to be high. Based on the description, the likely attack vector could be local access to a device or to a file export that contains the stored sensitive data. An attacker would need to obtain read access to the storage location; if the product leaks the data through configuration files or exposed APIs, remote exploitation could be possible. The overall risk remains moderate, but legitimate and malicious actors capable of accessing the storage medium should be considered.