EOS Network Tool CVE-2026-9260

Exploitation requires local access to a system on which Canon EOS Network Setting Tool version 1.5.0 or earlier is installed. The CVSS 4.0 vector (AV:L, PR:N) indicates that no elevated privileges are needed - any user with the ability to read the application binary on the local system can perform key extraction. The vulnerability is not conditional on a non-default configuration, active camera connectivity, or any particular application state; the hard-coded key is present in all deployments of affected versions. Exploitation is limited exclusively to confidentiality impact (VC:H) - no integrity modification or availability disruption is expected. The principal limiting factor is the requirement for local system presence: remote unauthenticated exploitation is not possible given the local attack vector.

The CVSS 4.0 score of 6.9 (Medium) accurately reflects a real but meaningfully scoped risk. The local attack vector (AV:L) is the dominant limiting factor: exploitation requires an attacker to already have presence on the workstation running the tool, substantially narrowing exposure compared to network-exploitable vulnerabilities. Within that constraint, however, exploitation is straightforward - attack complexity is low (AC:L), no privileges are required (PR:N), and no user interaction is needed (UI:N), so any local user or process can extract the key. The confidentiality impact is high (VC:H), as the recovered key enables decryption of otherwise protected data. No CISA KEV listing and no publicly available exploit code have been identified, suggesting this is not under active widespread exploitation. EPSS data was not provided in the source intelligence. The real-world priority depends on deployment context: systems running this tool in shared or multi-user environments face materially higher exposure than single-user workstations where local access is tightly controlled. No integrity or availability impact is expected, limiting the blast radius.

An attacker who has gained a local foothold on a workstation running Canon EOS Network Setting Tool version 1.5.0 or earlier runs a standard binary analysis utility - such as a strings extractor or disassembler - against the tool's executable to locate and recover the embedded cryptographic key. With the static key in hand, the attacker decrypts previously captured or locally stored network traffic between the tool and paired EOS cameras, exposing network configuration credentials or other sensitive setup data. No public proof-of-concept has been identified, but extraction of hard-coded keys from compiled binaries is a well-understood technique requiring minimal specialized skill.