This vulnerability (CVE-2026-9260) concerns the use of hard-coded cryptographic keys (CWE-321) in Canon EOS Network Setting Tool for Windows, specifically in version 1.5.0 or earlier. Hard-coded keys can be extracted by attackers, potentially compromising the confidentiality and integrity of cryptographic functions within the software. The CVSS 4.0 base score is 6.9, indicating a medium severity level. The vulnerability does not require user interaction, privileges, or network access but is locally exploitable with low attack complexity. No official fix or patch has been documented in the vendor advisory or related sources.

The use of hard-coded cryptographic keys can allow attackers with local access to recover these keys, potentially enabling them to decrypt sensitive data or bypass security mechanisms relying on these keys. This undermines the confidentiality and integrity guarantees of the affected software's cryptographic functions. However, exploitation requires local access, limiting the attack vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should minimize local access to systems running affected versions and consider alternative secure methods for network configuration. Monitor Canon's advisories for updates on patches or official mitigations.