The vulnerability is improper validation of server certificates in Canon EOS Network Setting Tool Version 1.5.0 or earlier. This flaw allows an attacker to present a fraudulent or self‑signed certificate during the tool's network connection, bypassing the certificate verification process. The consequence is that the tool may accept connections from an impersonated server, enabling a man‑in‑the‑middle attack that could intercept or tamper with configuration data exchanged between the tool and the camera.

Canon Inc. EOS Network Setting Tool for Windows and macOS, versions 1.5.0 or earlier.

The CVSS base score of 7.1 indicates a moderate impact with potential for remote exploitation. The EPSS score is below 1%, implying a very low probability that the vulnerability has been actively exploited in the wild as of this analysis. However, the failure to validate server certificates exposes users to MITM attacks when the tool communicates over untrusted networks. The vulnerability is not listed in the CISA KEV catalog.