EUVD-2026-37022
GHSA-hpfm-h576-jwmh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-observable cleartext FTP with no auth needed by the attacker, but the victim must actually perform an FTP upload (UI:R); only confidentiality of credentials and images is impacted.
Primary rating from Vendor (f98c90f0-e9bd-4fa7-911b-51993f3571fd).
CVSS VectorVendor: f98c90f0-e9bd-4fa7-911b-51993f3571fd
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
Use of a non-secure protocol as the default FTP configuration in Canon EOS Network Setting Tool Version 1.5.0 or earlier
AnalysisAI
Information disclosure in Canon EOS Network Setting Tool version 1.5.0 and earlier stems from an insecure default FTP configuration that transmits credentials and image data in cleartext over the network. Remote attackers positioned on the network path can intercept the unencrypted FTP traffic to capture authentication material and uploaded photographs. No public exploit identified at time of analysis, but the vulnerability is published with a Canon PSIRT advisory and CVSS 4.0 base score of 7.1.
Technical ContextAI
The Canon EOS Network Setting Tool is a utility used to configure network upload destinations (FTP, FTPS, SFTP) on Canon EOS DSLR and mirrorless camera bodies for transferring images from the camera to a remote server. CWE-1188 (Insecure Default Initialization of Resource) applies because the tool defaults to the legacy FTP protocol - which transmits the username, password, and file contents in cleartext - rather than defaulting to an encrypted alternative such as FTPS or SFTP. The underlying FTP protocol (RFC 959) provides no transport-layer confidentiality or integrity, so anyone capable of observing the network path (open Wi-Fi, hotel/event networks, on-path attacker) can read the contents of the session.
RemediationAI
Patch status from the available data is ambiguous: no exact fix version was provided in the input, so treat this as 'patch available per vendor advisory' and consult Canon PSIRT advisory CP2026-005 (https://psirt.canon/advisory-information/cp2026-005/) along with the regional Canon support pages for an updated version of the EOS Network Setting Tool and instructions. As a configuration-level mitigation that works immediately without waiting for an update, reconfigure each affected camera to use FTPS (FTP over TLS) or SFTP (SSH) instead of plain FTP for image upload - this requires that the destination server also support the chosen protocol and that valid certificates or SSH keys are deployed, which may need server-side work. Where encrypted upload is not feasible, restrict camera FTP uploads to a trusted, segmented network (for example a dedicated event VLAN with no untrusted clients) and avoid uploading over public, hotel, or shared Wi-Fi; the trade-off is reduced operational flexibility for photographers working in the field.
More in Eos Network Setting Tool
View allWeak SSH cryptographic algorithms in Canon EOS Network Setting Tool version 1.5.0 and earlier allow network-adjacent att
Information disclosure in Canon EOS Network Setting Tool version 1.5.0 and earlier stems from improper SSH host key vali
Improper TLS certificate validation in Canon EOS Network Setting Tool version 1.5.0 and earlier allows network-positione
Hard-coded cryptographic keys embedded in Canon EOS Network Setting Tool version 1.5.0 and earlier expose static decrypt
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today