This vulnerability (CVE-2026-9258) affects Canon EOS Network Setting Tool for Windows versions 1.5.0 and earlier. It is caused by improper validation of SSH host keys, which is a certificate validation weakness classified as CWE-295. The CVSS 4.0 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, and user interaction needed. The vulnerability does not affect confidentiality, integrity, or availability directly but compromises validation of SSH host keys, potentially enabling man-in-the-middle or spoofing attacks if exploited. No patch or official remediation has been announced as of the publication date.

The improper validation of SSH host keys could allow an attacker to impersonate a legitimate SSH server or intercept communications, undermining the trustworthiness of SSH connections established by the EOS Network Setting Tool. This could lead to unauthorized access or manipulation of network settings if an attacker successfully exploits the vulnerability. However, there are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when connecting to SSH servers using the EOS Network Setting Tool and verify SSH host keys through alternative trusted means if possible.