Which versions of Canon EOS Network Setting Tool are affected by CVE-2026-9258?

Credentials transmitted by Canon EOS Network Setting Tool 1.5.0 and earlier can be intercepted and stolen by attackers positioned on internal or transit networks, creating immediate risk of…

How to fix or mitigate CVE-2026-9258?

24 hours: Identify and inventory all systems running Canon EOS Network Setting Tool version 1.5.0 or earlier, document their purpose and network location. 7 days: Implement firewall rules restricting outbound SSH connections from affected systems to only authorized Canon-related endpoints; enable network monitoring and alerting on SSH traffic from these systems. 30 days: Contact Canon for patch timeline; develop migration plan to alternative tools or operational workarounds if no patch becomes available within 60 days.

Canon EOS Network Setting Tool CVE-2026-9258

Q: What is the CVSS score of CVE-2026-9258?

CVE-2026-9258 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-37018 HIGH

Improper Certificate Validation (CWE-295)

2026-06-16 f98c90f0-e9bd-4fa7-911b-51993f3571fd

GHSA-98v4-mv97-2f2x

Information Disclosure Eos Network Setting Tool

7.1

CVSS 4.0 · Vendor: f98c90f0-e9bd-4fa7-911b-51993f3571fd

Severity by source

Vendor (f98c90f0-e9bd-4fa7-911b-51993f3571fd) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-reachable but requires an active MITM position (AC:H) and the victim to initiate a transfer (UI:R); no auth needed (PR:N); confidentiality-only impact per the description.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (f98c90f0-e9bd-4fa7-911b-51993f3571fd).

CVSS VectorVendor: f98c90f0-e9bd-4fa7-911b-51993f3571fd

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 00:27 vuln.today

DescriptionCVE.org

Improper validation of SSH host keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier

AnalysisAI

Information disclosure in Canon EOS Network Setting Tool version 1.5.0 and earlier stems from improper SSH host key validation (CWE-295), allowing network-positioned attackers to impersonate legitimate SSH endpoints and harvest credentials or configuration data transmitted by the tool. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P, VC:H) indicates remote exploitation requiring user interaction with high confidentiality impact but no integrity or availability effects. There is no public exploit identified at time of analysis, and the issue is not on the CISA KEV list.

Technical ContextAI

The Canon EOS Network Setting Tool is a Canon-supplied utility used to configure network parameters (including FTP/SFTP transfer destinations) on EOS-series digital cameras. CWE-295 indicates the tool fails to properly validate the SSH host key presented by the remote server during connection establishment - meaning it either does not check the fingerprint against a trusted store, accepts any key, or does not warn on mismatch. This breaks the trust-on-first-use model that underpins SSH transport security and enables transparent man-in-the-middle interception of otherwise encrypted SSH/SFTP sessions used to upload images from cameras to remote servers.

RemediationAI

Patch available per vendor advisory - consult Canon PSIRT advisory CP2026-005 (https://psirt.canon/advisory-information/cp2026-005/) and the regional Canon support pages for the exact fixed version of the EOS Network Setting Tool, as the supplied input does not name a specific fixed build. Until the updated tool is installed, restrict use of the tool to trusted wired networks or a known-good Wi-Fi segment, avoid running SFTP transfers over public/hotel/conference Wi-Fi, and where feasible tunnel the SSH/SFTP traffic through a separately authenticated VPN so that any host-key spoofing only affects an already-attested channel; the trade-off is operational friction for photographers who rely on field transfers. Manually verifying the destination server fingerprint out-of-band before each transfer is theoretically possible but is unlikely to be reliable in practice given the tool's UI.