Canon EOS Network Setting Tool EUVD-2026-37021

Q: What is the CVSS score of EUVD-2026-37021?

EUVD-2026-37021 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-9261 HIGH

Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

2026-06-16 f98c90f0-e9bd-4fa7-911b-51993f3571fd

GHSA-7f48-x95j-2r8c

Information Disclosure Eos Network Setting Tool

7.6

CVSS 4.0 · Vendor: f98c90f0-e9bd-4fa7-911b-51993f3571fd

Severity by source

Vendor (f98c90f0-e9bd-4fa7-911b-51993f3571fd) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Network-path MitM against tool-initiated SSH; AC:H for crypto downgrade, UI:R because user must run the tool, PR:N, C/I high from session exposure, no availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (f98c90f0-e9bd-4fa7-911b-51993f3571fd).

CVSS VectorVendor: f98c90f0-e9bd-4fa7-911b-51993f3571fd

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

CVE Published

Jun 22, 2026 - 06:03 cve.org

HIGH 7.6

Analysis Generated

Jun 16, 2026 - 00:28 vuln.today

DescriptionCVE.org

Use of weak SSH cryptographic algorithms in Canon EOS Network Setting Tool Version 1.5.0 or earlier

AnalysisAI

Weak SSH cryptographic algorithms in Canon EOS Network Setting Tool version 1.5.0 and earlier allow network-adjacent attackers to undermine the confidentiality and integrity of SSH sessions used by the tool, per Canon PSIRT advisory CP2026-005. The CVSS 4.0 vector (AV:N/AC:H/UI:P/VC:H/VI:H) reflects high attack complexity and required user interaction, and there is no public exploit identified at time of analysis.

Technical ContextAI

The Canon EOS Network Setting Tool is a utility used to configure network and remote-shooting settings on Canon EOS cameras, and it relies on SSH to negotiate authenticated, encrypted sessions. CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) indicates the SSH client/server implementation in versions up to 1.5.0 still offers deprecated key-exchange, MAC, or cipher primitives (typical examples in this CWE class include CBC-mode ciphers, HMAC-MD5/SHA1, diffie-hellman-group1-sha1, and ssh-rsa with SHA-1). An adversary capable of influencing the negotiated SSH algorithms can downgrade the connection to a primitive vulnerable to known cryptanalytic or protocol attacks, weakening the cryptographic guarantees the user expects from SSH.

RemediationAI

Patch available per vendor advisory: update the Canon EOS Network Setting Tool to the fixed version published in Canon PSIRT advisory CP2026-005 (https://psirt.canon/advisory-information/cp2026-005/) and the regional Canon support pages (canon.jp, canon-europe.com, usa.canon.com URLs above); the exact fixed build number is not included in the input data and should be taken from those advisories. As compensating controls until the tool is updated, restrict use of the EOS Network Setting Tool to trusted, segmented networks (avoid public Wi-Fi and untrusted LANs), tunnel the SSH session over a VPN to remove network-path adversaries, and avoid pairing/configuring cameras in hostile environments - note the trade-off that this constrains field workflows for photographers and broadcast crews who rely on ad-hoc wireless setup.