CVE-2025-46409
Inadequate encryption strength issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). If this vulnerability is exploited, a function that requires authentication may be accessed by a remote unauthenticated attacker.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.18%
- CWE
- CWE-326
- Published
- 2025-08-28
- Last modified
- 2026-03-13
Affected products
- DOS Co., Ltd. SS1
Weakness type
Related vulnerabilities
- CVE-2026-86670 — aircheng-org iWebShop-5 Authentication Storage admin.php weak password hash
- CVE-2023-54356 — Kyverno before 1.9.5 Sweet32 Medium Strength Cipher Suites
- CVE-2026-81718 — openssl_encrypt before 1.4.9 Weak Cryptographic Parameters
- CVE-2026-79084 — Inadequate encryption strength in Notifications in Google Chrome on on Windows prior to...
- CVE-2026-74889 — openssl_encrypt before 1.4.0 Weak Key Derivation via HKDF
- CVE-2026-65777 — Active Directory Security Feature Bypass Vulnerability
- CVE-2026-9201 — Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling
- CVE-2026-59651 — BKS keystore accepts legacy version with 16-bit integrity MAC key