CVE-2026-9258 is a medium severity flaw (CVSS 6.5) in Canon EOS Network Setting Tool version 1.5.0 and earlier, on Windows and macOS. The tool does not properly validate SSH host keys. Update to the fixed release named in Canon's advisory CP2026-005, which the record does not spell out.
What's affected
- Product: Canon EOS Network Setting Tool, on Windows and macOS according to the record.
- Affected versions: 1.5.0 and earlier.
- Fixed version: the record does not name one. Canon's advisory CP2026-005 is the place to confirm the release that fixes it.
- Severity: CVSS 6.5, medium. The record does not mark it as exploited.
How to check if you're exposed
Open the tool on each Windows and macOS machine that has it and read the version from its About or version screen. Anything at 1.5.0 or earlier is in scope. If you manage a fleet, your software inventory or endpoint tooling can list installed copies of the application by name.
What to do now
- Read Canon's advisory CP2026-005 and note the fixed version of the EOS Network Setting Tool.
- Update every installed copy to that version, or remove the tool from machines that no longer need it.
- Until you have updated, use the tool only on networks you trust.
- Add the tool to your software inventory so the next advisory is easy to scope.
Why it matters
The record lists CWE-295. SSH host key validation is how a client knows it is talking to the right machine. If the tool skips or weakens that check, someone positioned on the network path could pose as the device and read what the tool sends. The CVSS vector shows network access, no privileges and a user action, with a high confidentiality impact.
This is a medium severity issue and it does not put a server at risk by itself. It matters because the tool is used to configure cameras on a network, and settings or credentials that pass through a weakly protected channel are worth protecting. Patch it with your next round of application updates.
Quick check
What does validating a host key actually protect?
It lets the client confirm the server is the one it expected, so a lookalike on the same network cannot silently take its place. Without it, encryption alone does not tell you who is on the other end.
Sources
- Canon PSIRT advisory CP2026-005 (listed in the CVE record; the page blocked automated access when this post was reviewed, so confirm the fixed version there)
- Canon USA notice CPA2026-005
- Canon Japan support notice
- Gold entry for CVE-2026-9258
Last reviewed: 19 October 2026.
