Canon EOS Network Setting Tool EUVD-2026-37022

Exploitation requires the victim to actively use the FTP upload feature configured by Canon EOS Network Setting Tool 1.5.0 or earlier with its default (plaintext FTP) protocol selection - this maps to the UI:P (passive user interaction) component of the CVSS vector. The attacker must also be on the network path between the camera and the FTP server (same Wi-Fi segment, compromised router, ISP-level position, or other on-path vantage), which limits practical attacks to shared/untrusted networks rather than trusted internal LANs. If the user has manually switched the tool to FTPS or SFTP, or uploads only over a trusted segmented network, the issue is not exploitable in practice even though the vulnerable default remains present.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality impact and no integrity or availability impact, requiring passive user interaction (the photographer actually using the FTP upload feature). This is consistent with an eavesdropping/credential-disclosure issue rather than remote code execution, and EPSS and KEV data were not provided, so widespread automated exploitation is unlikely; no public exploit identified at time of analysis. Real-world risk is highest for photojournalists, event photographers, and corporate users who upload over untrusted networks - for users only uploading inside trusted LANs with no on-path threat, practical risk is significantly lower than the 7.1 base score suggests. Notably, the issue is a default-configuration weakness, not a code defect, so it can be neutralised by configuration alone where the camera body and destination server support FTPS or SFTP.

A photographer at a press event uses Canon EOS Network Setting Tool defaults to upload images via FTP to a publishing server over conference Wi-Fi. An attacker on the same wireless segment runs a passive sniffer (e.g., Wireshark with an ftp filter) and captures the FTP USER/PASS exchange in cleartext together with the JPEG payloads, gaining both server credentials and embargoed imagery without any active exploitation of the camera or tool.