Canon EOS Network Setting Tool EUVD-2026-37021

Exploitation requires the victim to actively initiate an SSH-backed configuration session from the Canon EOS Network Setting Tool (UI:P, user interaction needed) while the attacker is positioned on the network path between the tool and the camera so the weak algorithm can be negotiated or downgraded, and the attacker must execute a cryptographic attack against the legacy SSH primitive (AC:H). Limiting factors are: only Canon EOS Network Setting Tool 1.5.0 or earlier is vulnerable; the attacker must be network-adjacent during a live setup session; no authentication is required on the attacker side (PR:N); and there is no impact to camera availability (VA:N), only to session confidentiality and integrity.

The CVSS 4.0 score of 7.6 (High) is tempered by AC:H and UI:P, which mean exploitation requires both elevated attack complexity and active user interaction - typically a user-initiated SSH session via the tool that the attacker can intercept or influence on the network path. PR:N confirms no authentication is needed by the attacker, and VC:H/VI:H reflect potential exposure of session contents and tampering, while VA:N indicates no direct availability impact. No CISA KEV listing, EPSS data, or SSVC decision input is provided, and no public exploit is identified at time of analysis, so this is not a mass-exploitation candidate; the practical risk is concentrated in environments where Canon EOS cameras are configured over untrusted networks (e.g., production sets, press events, hotel Wi-Fi). Realistic risk is moderate and targeted rather than wormable.

A photographer at an event uses the EOS Network Setting Tool over event Wi-Fi to configure a camera; an attacker on the same network performs an active man-in-the-middle and forces the SSH handshake to negotiate a weak cipher or KEX, then decrypts or tampers with the configuration session to recover Wi-Fi credentials, FTP upload tokens, or image metadata. No public exploit is identified at time of analysis, but the underlying weak-algorithm class has well-known cryptanalytic tooling.