CVE-2026-94459 - Vulnerability Details - OpenCVE

ReportizFlow

IRISPowerscan contain default user accounts with predictable credentials. An unauthenticated attacker with access to an affected installation could use these credentials to authenticate to the application and access functionality available to the affected accounts, potentially resulting in unauthorised access or modification of application data and configuration.

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Iris	Irispowerscan

No data.

No data.

References

Link	Providers
https://www.canon-europe.com/psirt/advisory-information

History

Fri, 06 Nov 2026 22:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Iris Iris irispowerscan
Vendors & Products		Iris Iris irispowerscan

Wed, 04 Nov 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		IRISPowerscan contain default user accounts with predictable credentials. An unauthenticated attacker with access to an affected installation could use these credentials to authenticate to the application and access functionality available to the affected accounts, potentially resulting in unauthorised access or modification of application data and configuration.
Title		IRISPowerscan Default accounts with predictable credentials
Weaknesses		CWE-1392
References		https://www.canon-europe.com/psirt/advisory-information
Metrics		cvssV4_0 `{'score': 7.2, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: Canon_EMEA

Published: 2026-11-04T09:11:26.699Z

Updated: 2026-11-04T09:11:26.699Z

Reserved: 2026-09-21T17:17:19.496Z

Link: CVE-2026-94459

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-11-04T10:17:26.833

Modified: 2026-11-04T10:17:26.833

Link: CVE-2026-94459

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-94459", "assignerOrgId": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3", "state": "PUBLISHED", "assignerShortName": "Canon_EMEA", "dateReserved": "2026-09-21T17:17:19.496Z", "datePublished": "2026-11-04T09:11:26.699Z", "dateUpdated": "2026-11-04T09:11:26.699Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3", "shortName": "Canon_EMEA", "dateUpdated": "2026-11-04T09:11:26.699Z"}, "title": "IRISPowerscan Default accounts with predictable credentials", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-1392", "description": "CWE-1392 Use of default credentials", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Not applicable"}]}], "affected": [{"vendor": "I.R.I.S S.A.", "product": "IRISPowerscan", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "12.3", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "IRISPowerscan contain\ndefault user accounts with predictable credentials. An unauthenticated attacker\nwith access to an affected installation could use these credentials to\nauthenticate to the application and access functionality available to the\naffected accounts, potentially resulting in unauthorised access or modification\nof application data and configuration.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "IRISPowerscan contain\ndefault user accounts with predictable credentials. An unauthenticated attacker\nwith access to an affected installation could use these credentials to\nauthenticate to the application and access functionality available to the\naffected accounts, potentially resulting in unauthorised access or modification\nof application data and configuration."}]}], "tags": ["x_cemea", "x_iris", "x_ips", "x_subsidiary"], "references": [{"url": "https://www.canon-europe.com/psirt/advisory-information", "tags": ["vendor-advisory", "mitigation", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.2, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Paul van der Haas working with Orange Cyberdefense", "type": "finder"}], "source": {"advisory": "CPE2026-057", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "IRISPowerscan", "vendor": "I.R.I.S S.A.", "versions": [{"lessThanOrEqual": "12.3", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IRISPowerscan contain\ndefault user accounts with predictable credentials. An unauthenticated attacker\nwith access to an affected installation could use these credentials to\nauthenticate to the application and access functionality available to the\naffected accounts, potentially resulting in unauthorised access or modification\nof application data and configuration."}], "id": "CVE-2026-94459", "lastModified": "2026-11-04T10:17:26.833", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3", "type": "Secondary"}]}, "published": "2026-11-04T10:17:26.833", "references": [{"source": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3", "url": "https://www.canon-europe.com/psirt/advisory-information"}], "sourceIdentifier": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1392"}], "source": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3", "type": "Secondary"}]}