CVE-2026-9259: Improper validation of server certificates in Canon EOS Network Setting Tool Version 1

Synopsis

Improper certificate validation (a classic man-in-the-middle weakness) affects Canon EOS Network Setting Tool version 1.5.0 and earlier on both Windows and macOS. The tool can be reached over the network without authentication, but an attacker must position themselves between the victim and the tool's server traffic and induce the victim to perform an action that triggers a network request. Successful exploitation allows the attacker to intercept and read confidential data in transit, including any credentials or configuration material exchanged during the session. HarborGuard is tracking this advisory for patch availability, as Canon has not yet published a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be positioned on a network path between the victim's host and the server the tool communicates with, enabling interception of traffic over the network.

• AuthenticationNot required

  No account or credential is needed to carry out the attack; the attacker only needs network positioning.

• Victim interactionRequired

  The victim must take an action that causes the tool to initiate a network request, such as launching a configuration session, for the attacker to intercept the unvalidated TLS exchange.

• Attack complexityDetail

  Exploit conditions are reliable and free of environmental prerequisites beyond network positioning; no race conditions or memory-layout factors are involved.

Blast Radius

• The attacker reads confidential data transmitted between the EOS Network Setting Tool and its server, which may include camera configuration payloads, network credentials, or authentication tokens.
• Because integrity (VI) and availability (VA) impacts are rated None, the attacker cannot modify data in transit or disrupt the tool's operation through this vulnerability alone.
• Any intercepted credentials can be reused in follow-on attacks against Canon account services or local network resources outside the scope of this CVE.