# CVE-2026-9259: Canon EOS Network Setting Tool improper certificate validation

Source: https://junglewise.ai/threats/cve-2026-9259-canon-eos-network-setting-tool-improper-certificate-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-16. Updated: 2026-06-16  
License: CC BY 4.0 with a link back

CVE-2026-9259 · Severity: medium · CVSS 6.5 · Published 2026-06-16

A vulnerability exists in the Canon EOS Network Setting Tool, a utility used to configure network connections for Canon cameras. An attacker could potentially intercept sensitive login credentials used for file transfers (FTP/FTPS/SFTP) by tricking the software into connecting to a malicious server. This could lead to the theft of account information and unauthorized access to image storage servers.

Technologies: [Canon EOS Network Setting Tool](https://junglewise.ai/threats/technologies/eos-network-setting-tool). Vendors: [Canon](https://junglewise.ai/threats/vendors/canon).

## Quick answers

**Is CVE-2026-9259 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9259 being exploited in the wild.

**How severe is CVE-2026-9259?** Medium severity, with a CVSS score of 6.5, published 16 June 2026.

**Which products and versions are affected?** Canon EOS Network Setting Tool 1.5.0 and earlier.

**Is there a fix for CVE-2026-9259?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9259 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-9259?** Check whether you run Canon EOS Network Setting Tool at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Canon EOS Network Setting Tool version 1.5.0 and earlier (included with EOS Utility Ver.3.12.0 through Ver.3.20.20) contains a CWE-295 vulnerability due to improper validation of server certificates. The flaw exists within the FTP/FTPS/SFTP communication test functions. A remote attacker can exploit this by performing a man-in-the-middle (MitM) attack or by inducing a user to connect to a rogue server, allowing for the disclosure of sensitive authentication credentials. Users are advised to update to EOS Utility Ver.3.20.21 or later to resolve the issue.

## Affected products

- Canon EOS Network Setting Tool 1.5.0 and earlier

## Timeline

- 2026-06-15: disclosed: Initial disclosure by Canon Inc.
- 2026-06-16: advisory: NVD publication date

## References

- [https://canon.jp/support/support-info/260615vulnerability-response](https://canon.jp/support/support-info/260615vulnerability-response)
- [https://psirt.canon/advisory-information/cp2026-005/](https://psirt.canon/advisory-information/cp2026-005/)
- [https://www.canon-europe.com/support/product-security/](https://www.canon-europe.com/support/product-security/)
- [https://www.usa.canon.com/about-us/to-our-customers/cpa2026-005-vulnerability-remediation-for-eos-network-setting-tool](https://www.usa.canon.com/about-us/to-our-customers/cpa2026-005-vulnerability-remediation-for-eos-network-setting-tool)

## Related threats

- [Canon EOS Network Setting Tool insecure default FTP configuration](https://junglewise.ai/threats/cve-2026-9262-canon-eos-network-setting-tool-insecure-default-ftp-configuration)
- [Canon EOS Network Setting Tool weak SSH cryptographic algorithms](https://junglewise.ai/threats/cve-2026-9261-canon-eos-network-setting-tool-weak-ssh-cryptographic-algorithms)
- [Canon EOS Network Setting Tool hard-coded cryptographic keys](https://junglewise.ai/threats/cve-2026-9260-canon-eos-network-setting-tool-hard-coded-cryptographic-keys)
- [Canon EOS Network Setting Tool improper SSH host key validation](https://junglewise.ai/threats/cve-2026-9258-canon-eos-network-setting-tool-improper-ssh-host-key-validation)