Canon EOS Network Setting Tool CVE-2026-9258

Exploitation requires (1) the victim to actively initiate an SSH/SFTP connection from the EOS Network Setting Tool version 1.5.0 or earlier - consistent with the CVSS UI:P (passive user interaction) metric - and (2) the attacker to occupy a network man-in-the-middle position between the camera/tool host and the legitimate destination server (rogue Wi-Fi AP, ARP spoofing on a shared LAN, upstream ISP/router compromise, or DNS hijack). Limiting factors: the attack only yields confidentiality impact (VC:H, VI:N, VA:N), so it cannot directly modify camera firmware or destination data; it does not work against users who only run the tool on a fully trusted segment with no MITM opportunity; and it depends on the victim choosing to transfer over the compromised path during the attacker's window of access.

The CVSS 4.0 base of 7.1 reflects a network-reachable, low-complexity issue with confidentiality-only impact (VC:H, VI:N, VA:N) requiring passive user interaction (UI:P) - consistent with a photographer initiating an SFTP transfer over an attacker-controlled network. No EPSS, KEV, or SSVC data was supplied, and no public exploit identified at time of analysis, so this is not a mass-exploitation candidate. Real-world risk is concentrated against targeted users (photojournalists, event photographers transferring sensitive imagery over hostile Wi-Fi); for users who only operate the tool on trusted LANs, exposure is much lower than the score implies. The CVSS vector and the description are consistent, but no patched version number is enumerated in the supplied data - defenders should consult the linked Canon PSIRT advisory CP2026-005 to confirm the fixed build.

An attacker on the same Wi-Fi network as a photographer (for example, at a press event or hotel) sets up a rogue access point or performs ARP/DNS spoofing and presents an attacker-controlled SSH server when the EOS Network Setting Tool initiates an SFTP image transfer. Because the tool does not properly validate the host key, the session is established with the attacker, who captures the SFTP credentials and any uploaded image data in cleartext from the attacker's perspective. No public exploit identified at time of analysis, but the required tooling (mitmproxy-style SSH MITM, e.g., ssh-mitm) is readily available.