CVE-2026-9258

CriticalCVSS 9.8/10Last modified Jun 18, 2026

Description

Improper validation of SSH host keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
Canon Inc.	EOS Network Setting Tool for Windows	1.5.0 or earlier
Canon Inc.	EOS Network Setting Tool for macOS	1.5.0 or earlier

References

https://canon.jp/support/support-info/260615vulnerability-responseVendor Advisory
https://psirt.canon/advisory-information/cp2026-005/Vendor Advisory
https://www.canon-europe.com/support/product-security/Vendor Advisory
https://www.usa.canon.com/about-us/to-our-customers/cpa2026-005-vulnerability-remediation-for-eos-network-setting-toolVendor Advisory

Timeline

Published: Jun 16, 2026
Last modified: Jun 18, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-925808.8In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php (line ~2 CVE-2026-925814.3In AVideo through 29.0, Like::__construct() performs counter arithmetic on raw request values before validation, allowing array-typed parame CVE-2026-925827.1AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVid CVE-2026-925836.5AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate limit counters, all CVE-2026-925846.1AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site scripting vulnerability. The unauthenticated view-counter endp CVE-2026-925854.3AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the API like endpoint, a CVE-2026-925864.3AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the set_api_comment functi CVE-2026-925875.0n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against CVE-2026-925884.4n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set CVE-2026-925894.3Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder endpoint. When an au CVE-2026-92599.8Improper validation of server certificates in Canon EOS Network Setting Tool Version 1.5.0 or earlier CVE-2026-925905.4Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disabl