CVE-2026-9258: Improper validation of SSH host keys in Canon EOS Network Setting Tool Version 1

Synopsis

This is an SSH host key validation bypass (a man-in-the-middle attack enabler) in Canon EOS Network Setting Tool version 1.5.0 and earlier, for both Windows and macOS. The tool can be reached over the network without any authentication, but requires the victim to take an action, such as initiating a file transfer or connection through the tool. Successful exploitation allows an attacker positioned between the victim and the SSH server to read confidential data the tool exchanges over what the user believes is a secure channel. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment Canon publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be positioned on the network path between the victim's host and the SSH server to intercept and manipulate the connection.

• AuthenticationNot required

  No credentials or account are required; the attacker needs only a suitable network position.

• Victim interactionRequired

  The victim must initiate an SSH-based action through the Canon EOS Network Setting Tool, such as connecting to or transferring files with a remote host.

• Attack complexityDetail

  The exploit is reliable and imposes no additional environmental conditions beyond the attacker's network position; no race conditions or special memory layout are required.

Blast Radius

• An attacker intercepts SSH session traffic and reads confidential data exchanged between the Canon EOS Network Setting Tool and the remote SSH server, such as camera configuration data, credentials passed over the session, or transferred files.
• Because host key validation is bypassed, the attacker can silently impersonate the target SSH server for the duration of any session the victim initiates.
• Integrity of data in transit and the identity of the remote server cannot be confirmed by the client, leaving every tool-initiated SSH session open to passive surveillance for the session's lifetime.