SS1 and rocoeyes asset agents patched against remote file deletion

SS1 and rocoeyes asset agents patched against remote file deletion

9 November 2026: DOS Co., Ltd. and Rococo Co. Ltd. have fixed two flaws in the agents of the SS1, SS1 Cloud and rocoeyes IT asset management tools, the more serious of which, CVE-2026-113437, lets an attacker delete arbitrary files over the network without logging in. Japan's vulnerability portal JVN scores it 6.9 on CVSS 4.0 and does not report exploitation. Agents run on every managed endpoint, so the fix has to reach the whole estate.

Not yet independently verified. This rests on JVN#76179675, published 9 November 2026. The vendors' own notices, in Japanese, were not read, and JVN does not say whether either flaw has been exploited. We will update this when it can be confirmed, and remove this note.

Two flaws with different reach

CVE-2026-113437 is a path traversal (CWE-22), rated 6.9 on CVSS 4.0 and 5.3 on CVSS 3.0, with a network attack vector and no privileges or user action required. It affects SS1 Agent 17.0.0.50 and earlier, SS1 Cloud Agent 3.2.0 and earlier, and rocoeyes Agent 3.1.1 and earlier.

CVE-2026-109582 is insecure storage of sensitive information (CWE-922), rated 5.1 on CVSS 4.0 and 4.0 on CVSS 3.0. It needs local access, and JVN says sensitive information used by the product may be obtained. It is listed against SS1 Agent 17.0.0.50 and earlier, which corresponds to media version 17.0.0e, and not against the cloud agent or rocoeyes.

The practical risk of the first is denial of service on the endpoint. An agent that can remove any file its process can reach may take out configuration, logs or applications. JVN does not state which privileges the agent runs with, so administrators should check how the service is configured on their own machines.

Fixed versions by release line

SS1 fixes are available for ten release lines, written as version and media version:

• 17.1.0.10 (17.1.0a) and 17.0.0.60 (17.0.0f)
• 16.1.0.100 (16.1.0j) and 16.0.0.60 (16.0.0f)
• 15.1.0.70 (15.1.0g) and 15.0.0.80 (15.0.0h)
• 14.1.0.90 (14.1.0i) and 14.0.0.90 (14.0.0i)
• 13.1.0.100 (13.1.0j) and 13.0.0.90 (13.0.0i)

For SS1 Cloud the fixed agents are 3.1.1a in the 3.1 series and 3.2.0a in the 3.2 series. Rocoeyes customers need Agent 3.1.1a. Rocoeyes is an ODM version of the product, sold by Rococo, so buyers who know it only under that name should not assume the SS1 notice has reached them.

Who found them, and how to prioritise

Murashima Masahiro of GMO Cybersecurity by Ierae reported the storage flaw to IPA, and Christoph Senn reported the path traversal to JPCERT/CC, which coordinated with the developer in both cases.

Because the file-deletion flaw is reachable from the network, endpoints on segments that can be reached from less trusted ones should come first, along with any machines where the agent port is open beyond the management server. Older versions than those above are not listed as fixed, so a site on a release before the 13.0 line should ask DOS for its upgrade path.

Our IT asset management category holds five products, including Snipe-IT and InvGate IT Asset Management.

Related on TrustList:

• AssetView flaw lets a logged-in Windows user gain SYSTEM rights

Sources

• JVN#76179675: Multiple Vulnerabilities in SS1/ SS1 Cloud and the ODM product rocoeyes, 9 November 2026