EOS Network Tool CVE-2026-9260

Q: What is the CVSS score of CVE-2026-9260?

CVE-2026-9260 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-37020 MEDIUM

Use of Hard-coded Cryptographic Key (CWE-321)

2026-06-16 f98c90f0-e9bd-4fa7-911b-51993f3571fd

GHSA-q354-79q7-wx65

Information Disclosure Eos Network Setting Tool

6.9

CVSS 4.0 · Vendor: f98c90f0-e9bd-4fa7-911b-51993f3571fd

Severity by source

Vendor (f98c90f0-e9bd-4fa7-911b-51993f3571fd) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.2 MEDIUM

Hard-coded key resides in a locally accessible binary readable by any user, yielding high confidentiality loss with no integrity or availability impact.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (f98c90f0-e9bd-4fa7-911b-51993f3571fd).

CVSS VectorVendor: f98c90f0-e9bd-4fa7-911b-51993f3571fd

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 00:29 vuln.today

DescriptionCVE.org

Use of hard-coded cryptographic keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier

AnalysisAI

Hard-coded cryptographic keys embedded in Canon EOS Network Setting Tool version 1.5.0 and earlier expose static decryption material to any local system user, enabling unauthorized decryption of protected network traffic or configuration data exchanged between the tool and Canon EOS cameras. The flaw is CWE-321 (Use of Hard-coded Cryptographic Key) and is classified as an information disclosure vulnerability with high confidentiality impact, bounded by the requirement for local system access. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Canon EOS Network Setting Tool is a desktop utility for configuring network parameters on Canon EOS digital cameras, likely employing cryptographic keys to protect communication or stored configuration data between the host and camera hardware. CWE-321 describes the class of flaw where a static cryptographic key is compiled or embedded directly into the application binary rather than generated at runtime or stored in a protected keystore. Because the key is invariant across all deployments, it can be recovered using standard binary analysis techniques such as string extraction or disassembly without needing access to source code. The CVSS 4.0 vector (AV:L) confirms the attack surface is local to the host machine. The impact metrics indicate exclusively confidentiality loss (VC:H) with no integrity (VI:N) or availability (VA:N) consequence, consistent with a key-extraction scenario where the attacker decrypts captured data but cannot modify or disrupt the system. No CPE strings were provided in the source data; affected scope is derived from Canon's multi-region advisory references.

RemediationAI

The primary remediation is to update Canon EOS Network Setting Tool to the version specified in Canon's security advisories at https://psirt.canon/advisory-information/cp2026-005/ and https://www.usa.canon.com/about-us/to-our-customers/cpa2026-005-vulnerability-remediation-for-eos-network-setting-tool - an exact patched version number has not been independently confirmed from the available input data, so consult the advisory directly to identify the correct replacement release. As a compensating control prior to patching, restrict local system access to the workstation running the tool to authorized personnel only, reducing the set of users who could extract the embedded key from the binary. Additionally, organizations should consider any data previously encrypted or protected by this tool as potentially compromised if untrusted users have had local access to affected systems, and evaluate whether re-encryption or credential rotation is warranted for sensitive camera configuration data. Removing or uninstalling the tool on systems where it is not operationally required is also an effective interim measure with no functional side effects for those deployments.