{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-95649", "assignerOrgId": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3", "state": "PUBLISHED", "assignerShortName": "Canon_EMEA", "dateReserved": "2026-09-22T11:58:00.080Z", "datePublished": "2026-11-04T09:14:14.423Z", "dateUpdated": "2026-11-04T09:14:14.423Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3", "shortName": "Canon_EMEA", "dateUpdated": "2026-11-04T09:14:14.423Z"}, "title": "IRISPowerscan Insufficient restriction of untrusted scripts allows arbitrary code execution", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-829", "description": "CWE-829 Inclusion of functionality from untrusted control sphere", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Not applicable"}]}], "affected": [{"vendor": "I.R.I.S S.A.", "product": "IRISPowerscan", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "12.3", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "IRISPowerscan insufficiently restrict the use of\nuntrusted scripts. An authenticated user with access to script functionality\ncan import or modify scripts that are executed by the application, potentially\nresulting in arbitrary code execution in the security context of the Windows\nuser running IRISPowerscan.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "IRISPowerscan insufficiently restrict the use of\nuntrusted scripts. An authenticated user with access to script functionality\ncan import or modify scripts that are executed by the application, potentially\nresulting in arbitrary code execution in the security context of the Windows\nuser running IRISPowerscan."}]}], "tags": ["x_cemea", "x_iris", "x_ips", "x_subsidiary"], "references": [{"url": "https://www.canon-europe.com/psirt/advisory-information", "tags": ["vendor-advisory", "mitigation", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.1, "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Paul van der Haas working with Orange Cyberdefense", "type": "finder"}], "source": {"advisory": "CPE2026-057", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "IRISPowerscan", "vendor": "I.R.I.S S.A.", "versions": [{"lessThanOrEqual": "12.3", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IRISPowerscan insufficiently restrict the use of\nuntrusted scripts. An authenticated user with access to script functionality\ncan import or modify scripts that are executed by the application, potentially\nresulting in arbitrary code execution in the security context of the Windows\nuser running IRISPowerscan."}], "id": "CVE-2026-95649", "lastModified": "2026-11-04T10:17:27.120", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3", "type": "Secondary"}]}, "published": "2026-11-04T10:17:27.120", "references": [{"source": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3", "url": "https://www.canon-europe.com/psirt/advisory-information"}], "sourceIdentifier": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-829"}], "source": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3", "type": "Secondary"}]}

{}