Canon EOS Network Setting Tool CVE-2026-9259

Attacker must hold an on-path network position between the victim host running EOS Network Setting Tool 1.5.0 or earlier and the remote TLS endpoint (Canon backend or user-configured upload server). The victim must actively launch and use the tool during the attacker's window (UI:P - passive user interaction such as initiating a configuration session is required, not a click on a malicious link). Exploitation is limited to confidentiality of data flowing through that session - no code execution, no integrity tampering of the host, and no persistence; restricted to platforms where the tool runs (Windows/macOS variants Canon publishes).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N) shows a network-reachable, low-complexity, unauthenticated attack but with passive user interaction required and only confidentiality impact - no integrity or availability damage. No EPSS, KEV, or POC data was provided, so this does not appear to be under active exploitation. Real-world risk is moderate rather than urgent: exploitation demands an attacker already on the same network path during the brief window a photographer runs the configuration tool, which is uncommon outside targeted scenarios (hostile Wi-Fi at events, supply chain). Treat this as a configuration-tool client-side flaw rather than a server-side panic-button - meaningful for professional photographers handling sensitive shoots, low priority for general consumers.

A photographer joins a conference or hotel Wi-Fi and launches the EOS Network Setting Tool to register a new FTP upload destination or web service. An attacker on the same network performs ARP spoofing and presents a forged TLS certificate to the tool, which fails to validate it and proceeds - letting the attacker observe credentials, account tokens, or configuration data transmitted to Canon's image.canon or registered upload endpoints.