5
CVEs
0
Critical
4
High
0
KEV
0
PoC
4
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
4
MEDIUM
1
LOW
0
Monthly CVE Trend
Affected Products (30)
Lbp237dw Firmware
10
Mf455dw Firmware
10
Mf1643if Ii Firmware
10
Lbp236dw Firmware
10
Lbp632cdw Firmware
10
Mf654cdw Firmware
10
Mf1238 Ii Firmware
10
Lbp633cdw Firmware
10
Mf453dw Firmware
10
Mf1643i Ii Firmware
10
Mf653cdw Firmware
10
Mf656cdw Firmware
10
Mf451dw Firmware
10
I Sensys Lbp633Cdw Firmware
10
Mf452dw Firmware
10
Lbp1238 Ii Firmware
10
Mf652cw Firmware
10
Mf644Cdw Firmware
9
I Sensys Mf643Cdw Firmware
9
Lbp621C Firmware
9
I Sensys X C1127I Firmware
9
I Sensys Lbp664Cx Firmware
9
Lbp122Dw Firmware
9
I Sensys Mf641Cw Firmware
9
Mf745Cdw Firmware
9
Maxify Gx3020 Firmware
9
Mf269Dw Ii Firmware
9
Mf641Cw Firmware
9
I Sensys Mf645Cx Firmware
9
Lbp1127C Firmware
9
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-9261 | Weak SSH cryptographic algorithms in Canon EOS Network Setting Tool version 1.5.0 and earlier allow network-adjacent attackers to undermine the confidentiality and integrity of SSH sessions used by the tool, per Canon PSIRT advisory CP2026-005. The CVSS 4.0 vector (AV:N/AC:H/UI:P/VC:H/VI:H) reflects high attack complexity and required user interaction, and there is no public exploit identified at time of analysis. | HIGH | 7.6 | 0.2% | 38 |
No patch
|
| CVE-2026-9262 | Information disclosure in Canon EOS Network Setting Tool version 1.5.0 and earlier stems from an insecure default FTP configuration that transmits credentials and image data in cleartext over the network. Remote attackers positioned on the network path can intercept the unencrypted FTP traffic to capture authentication material and uploaded photographs. No public exploit identified at time of analysis, but the vulnerability is published with a Canon PSIRT advisory and CVSS 4.0 base score of 7.1. | HIGH | 7.1 | 0.3% | 36 |
No patch
|
| CVE-2026-9258 | Information disclosure in Canon EOS Network Setting Tool version 1.5.0 and earlier stems from improper SSH host key validation (CWE-295), allowing network-positioned attackers to impersonate legitimate SSH endpoints and harvest credentials or configuration data transmitted by the tool. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P, VC:H) indicates remote exploitation requiring user interaction with high confidentiality impact but no integrity or availability effects. There is no public exploit identified at time of analysis, and the issue is not on the CISA KEV list. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-9259 | Improper TLS certificate validation in Canon EOS Network Setting Tool version 1.5.0 and earlier allows network-positioned attackers to intercept communications between the tool and Canon servers via man-in-the-middle attacks. The flaw enables disclosure of sensitive information transmitted during camera network configuration, though no public exploit identified at time of analysis. CVSS 4.0 score of 7.1 reflects high confidentiality impact but requires user interaction (UI:P) to be successful. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-9260 | Hard-coded cryptographic keys embedded in Canon EOS Network Setting Tool version 1.5.0 and earlier expose static decryption material to any local system user, enabling unauthorized decryption of protected network traffic or configuration data exchanged between the tool and Canon EOS cameras. The flaw is CWE-321 (Use of Hard-coded Cryptographic Key) and is classified as an information disclosure vulnerability with high confidentiality impact, bounded by the requirement for local system access. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog. | MEDIUM | 6.9 | 0.1% | 35 |
No patch
|