Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-95649 (GCVE-0-2026-95649)

Vulnerability from nvd – Published: 2026-11-04 09:14 – Updated: 2026-11-04 09:14 X_Cemea X_Iris X_Ips X_Subsidiary

Title

IRISPowerscan Insufficient restriction of untrusted scripts allows arbitrary code execution

Summary

IRISPowerscan insufficiently restrict the use of untrusted scripts. An authenticated user with access to script functionality can import or modify scripts that are executed by the application, potentially resulting in arbitrary code execution in the security context of the Windows user running IRISPowerscan.

Severity

6.1 (Medium)


                        
                          CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N

CWE

CWE-829 - Inclusion of functionality from untrusted control sphere

Assigner

Canon_EMEA CNA under the mitre root

CNA scorecard – unranked: 5 records in the last 180 days, 10 needed details

References

1 reference

URL	Tags
https://www.canon-europe.com/psirt/advisory-information	vendor-advisorymitigationpatch

Impacted products

1 product

Vendor	Product	Version
I.R.I.S S.A.	IRISPowerscan	Affected: 0 , ≤ 12.3 (custom)

Credits

Paul van der Haas working with Orange Cyberdefense

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "IRISPowerscan",
          "vendor": "I.R.I.S S.A.",
          "versions": [
            {
              "lessThanOrEqual": "12.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Paul van der Haas working with Orange Cyberdefense"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IRISPowerscan insufficiently restrict the use of\nuntrusted scripts. An authenticated user with access to script functionality\ncan import or modify scripts that are executed by the application, potentially\nresulting in arbitrary code execution in the security context of the Windows\nuser running IRISPowerscan."
            }
          ],
          "value": "IRISPowerscan insufficiently restrict the use of\nuntrusted scripts. An authenticated user with access to script functionality\ncan import or modify scripts that are executed by the application, potentially\nresulting in arbitrary code execution in the security context of the Windows\nuser running IRISPowerscan."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Not applicable"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-829",
              "description": "CWE-829 Inclusion of functionality from untrusted control sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T09:14:14.423Z",
        "orgId": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3",
        "shortName": "Canon_EMEA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "mitigation",
            "patch"
          ],
          "url": "https://www.canon-europe.com/psirt/advisory-information"
        }
      ],
      "source": {
        "advisory": "CPE2026-057",
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_cemea",
        "x_iris",
        "x_ips",
        "x_subsidiary"
      ],
      "title": "IRISPowerscan Insufficient restriction of untrusted scripts allows arbitrary code execution",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3",
    "assignerShortName": "Canon_EMEA",
    "cveId": "CVE-2026-95649",
    "datePublished": "2026-11-04T09:14:14.423Z",
    "dateReserved": "2026-09-22T11:58:00.080Z",
    "dateUpdated": "2026-11-04T09:14:14.423Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-94460 (GCVE-0-2026-94460)

Vulnerability from nvd – Published: 2026-11-04 09:12 – Updated: 2026-11-04 09:12 X_Cemea X_Iris X_Ips X_Subsidiary

Title

IRISPowerscan Insecure default privilege assignment for installation account

Summary

IRISPowerscan contain an insecure default configuration where the built-in installation account is assigned elevated privileges with a predictable password, which could allow an unauthenticated attacker to gain unauthorised access to privileged application functionality.

Severity

7.2 (High)


                        
                          CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

CWE

CWE-276 - Incorrect default permissions

Assigner

Canon_EMEA CNA under the mitre root

CNA scorecard – unranked: 5 records in the last 180 days, 10 needed details

References

1 reference

URL	Tags
https://www.canon-europe.com/psirt/advisory-information	vendor-advisorymitigationpatch

Impacted products

1 product

Vendor	Product	Version
I.R.I.S S.A.	IRISPowerscan	Affected: 0 , ≤ 12.3 (custom)

Credits

Paul van der Haas working with Orange Cyberdefense

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "IRISPowerscan",
          "vendor": "I.R.I.S S.A.",
          "versions": [
            {
              "lessThanOrEqual": "12.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Paul van der Haas working with Orange Cyberdefense"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IRISPowerscan contain an insecure default\nconfiguration where the built-in installation account is assigned elevated\nprivileges with a predictable password, which could allow an unauthenticated\nattacker to gain unauthorised access to privileged application functionality."
            }
          ],
          "value": "IRISPowerscan contain an insecure default\nconfiguration where the built-in installation account is assigned elevated\nprivileges with a predictable password, which could allow an unauthenticated\nattacker to gain unauthorised access to privileged application functionality."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Not applicable"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "CWE-276 Incorrect default permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T09:12:46.874Z",
        "orgId": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3",
        "shortName": "Canon_EMEA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "mitigation",
            "patch"
          ],
          "url": "https://www.canon-europe.com/psirt/advisory-information"
        }
      ],
      "source": {
        "advisory": "CPE2026-057",
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_cemea",
        "x_iris",
        "x_ips",
        "x_subsidiary"
      ],
      "title": "IRISPowerscan Insecure default privilege assignment for installation account",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3",
    "assignerShortName": "Canon_EMEA",
    "cveId": "CVE-2026-94460",
    "datePublished": "2026-11-04T09:12:46.874Z",
    "dateReserved": "2026-09-21T17:17:20.664Z",
    "dateUpdated": "2026-11-04T09:12:46.874Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-94459 (GCVE-0-2026-94459)

Vulnerability from nvd – Published: 2026-11-04 09:11 – Updated: 2026-11-04 09:11 X_Cemea X_Iris X_Ips X_Subsidiary

Title

IRISPowerscan Default accounts with predictable credentials

Summary

IRISPowerscan contain default user accounts with predictable credentials. An unauthenticated attacker with access to an affected installation could use these credentials to authenticate to the application and access functionality available to the affected accounts, potentially resulting in unauthorised access or modification of application data and configuration.

Severity

7.2 (High)


                        
                          CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

CWE

CWE-1392 - Use of default credentials

Assigner

Canon_EMEA CNA under the mitre root

CNA scorecard – unranked: 5 records in the last 180 days, 10 needed details

References

1 reference

URL	Tags
https://www.canon-europe.com/psirt/advisory-information	vendor-advisorymitigationpatch

Impacted products

1 product

Vendor	Product	Version
I.R.I.S S.A.	IRISPowerscan	Affected: 0 , ≤ 12.3 (custom)

Credits

Paul van der Haas working with Orange Cyberdefense

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "IRISPowerscan",
          "vendor": "I.R.I.S S.A.",
          "versions": [
            {
              "lessThanOrEqual": "12.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Paul van der Haas working with Orange Cyberdefense"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IRISPowerscan contain\ndefault user accounts with predictable credentials. An unauthenticated attacker\nwith access to an affected installation could use these credentials to\nauthenticate to the application and access functionality available to the\naffected accounts, potentially resulting in unauthorised access or modification\nof application data and configuration."
            }
          ],
          "value": "IRISPowerscan contain\ndefault user accounts with predictable credentials. An unauthenticated attacker\nwith access to an affected installation could use these credentials to\nauthenticate to the application and access functionality available to the\naffected accounts, potentially resulting in unauthorised access or modification\nof application data and configuration."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Not applicable"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1392",
              "description": "CWE-1392 Use of default credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T09:11:26.699Z",
        "orgId": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3",
        "shortName": "Canon_EMEA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "mitigation",
            "patch"
          ],
          "url": "https://www.canon-europe.com/psirt/advisory-information"
        }
      ],
      "source": {
        "advisory": "CPE2026-057",
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_cemea",
        "x_iris",
        "x_ips",
        "x_subsidiary"
      ],
      "title": "IRISPowerscan Default accounts with predictable credentials",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3",
    "assignerShortName": "Canon_EMEA",
    "cveId": "CVE-2026-94459",
    "datePublished": "2026-11-04T09:11:26.699Z",
    "dateReserved": "2026-09-21T17:17:19.496Z",
    "dateUpdated": "2026-11-04T09:11:26.699Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-95649 (GCVE-0-2026-95649)

Vulnerability from cvelistv5 – Published: 2026-11-04 09:14 – Updated: 2026-11-04 09:14 X_Cemea X_Iris X_Ips X_Subsidiary

Title

IRISPowerscan Insufficient restriction of untrusted scripts allows arbitrary code execution

Summary

IRISPowerscan insufficiently restrict the use of untrusted scripts. An authenticated user with access to script functionality can import or modify scripts that are executed by the application, potentially resulting in arbitrary code execution in the security context of the Windows user running IRISPowerscan.

Severity

6.1 (Medium)


                        
                          CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N

CWE

CWE-829 - Inclusion of functionality from untrusted control sphere

Assigner

Canon_EMEA CNA under the mitre root

CNA scorecard – unranked: 5 records in the last 180 days, 10 needed details

References

1 reference

URL	Tags
https://www.canon-europe.com/psirt/advisory-information	vendor-advisorymitigationpatch

Impacted products

1 product

Vendor	Product	Version
I.R.I.S S.A.	IRISPowerscan	Affected: 0 , ≤ 12.3 (custom)

Credits

Paul van der Haas working with Orange Cyberdefense

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "IRISPowerscan",
          "vendor": "I.R.I.S S.A.",
          "versions": [
            {
              "lessThanOrEqual": "12.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Paul van der Haas working with Orange Cyberdefense"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IRISPowerscan insufficiently restrict the use of\nuntrusted scripts. An authenticated user with access to script functionality\ncan import or modify scripts that are executed by the application, potentially\nresulting in arbitrary code execution in the security context of the Windows\nuser running IRISPowerscan."
            }
          ],
          "value": "IRISPowerscan insufficiently restrict the use of\nuntrusted scripts. An authenticated user with access to script functionality\ncan import or modify scripts that are executed by the application, potentially\nresulting in arbitrary code execution in the security context of the Windows\nuser running IRISPowerscan."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Not applicable"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-829",
              "description": "CWE-829 Inclusion of functionality from untrusted control sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T09:14:14.423Z",
        "orgId": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3",
        "shortName": "Canon_EMEA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "mitigation",
            "patch"
          ],
          "url": "https://www.canon-europe.com/psirt/advisory-information"
        }
      ],
      "source": {
        "advisory": "CPE2026-057",
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_cemea",
        "x_iris",
        "x_ips",
        "x_subsidiary"
      ],
      "title": "IRISPowerscan Insufficient restriction of untrusted scripts allows arbitrary code execution",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3",
    "assignerShortName": "Canon_EMEA",
    "cveId": "CVE-2026-95649",
    "datePublished": "2026-11-04T09:14:14.423Z",
    "dateReserved": "2026-09-22T11:58:00.080Z",
    "dateUpdated": "2026-11-04T09:14:14.423Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-94460 (GCVE-0-2026-94460)

Vulnerability from cvelistv5 – Published: 2026-11-04 09:12 – Updated: 2026-11-04 09:12 X_Cemea X_Iris X_Ips X_Subsidiary

Title

IRISPowerscan Insecure default privilege assignment for installation account

Summary

IRISPowerscan contain an insecure default configuration where the built-in installation account is assigned elevated privileges with a predictable password, which could allow an unauthenticated attacker to gain unauthorised access to privileged application functionality.

Severity

7.2 (High)


                        
                          CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

CWE

CWE-276 - Incorrect default permissions

Assigner

Canon_EMEA CNA under the mitre root

CNA scorecard – unranked: 5 records in the last 180 days, 10 needed details

References

1 reference

URL	Tags
https://www.canon-europe.com/psirt/advisory-information	vendor-advisorymitigationpatch

Impacted products

1 product

Vendor	Product	Version
I.R.I.S S.A.	IRISPowerscan	Affected: 0 , ≤ 12.3 (custom)

Credits

Paul van der Haas working with Orange Cyberdefense

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "IRISPowerscan",
          "vendor": "I.R.I.S S.A.",
          "versions": [
            {
              "lessThanOrEqual": "12.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Paul van der Haas working with Orange Cyberdefense"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IRISPowerscan contain an insecure default\nconfiguration where the built-in installation account is assigned elevated\nprivileges with a predictable password, which could allow an unauthenticated\nattacker to gain unauthorised access to privileged application functionality."
            }
          ],
          "value": "IRISPowerscan contain an insecure default\nconfiguration where the built-in installation account is assigned elevated\nprivileges with a predictable password, which could allow an unauthenticated\nattacker to gain unauthorised access to privileged application functionality."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Not applicable"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "CWE-276 Incorrect default permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T09:12:46.874Z",
        "orgId": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3",
        "shortName": "Canon_EMEA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "mitigation",
            "patch"
          ],
          "url": "https://www.canon-europe.com/psirt/advisory-information"
        }
      ],
      "source": {
        "advisory": "CPE2026-057",
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_cemea",
        "x_iris",
        "x_ips",
        "x_subsidiary"
      ],
      "title": "IRISPowerscan Insecure default privilege assignment for installation account",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3",
    "assignerShortName": "Canon_EMEA",
    "cveId": "CVE-2026-94460",
    "datePublished": "2026-11-04T09:12:46.874Z",
    "dateReserved": "2026-09-21T17:17:20.664Z",
    "dateUpdated": "2026-11-04T09:12:46.874Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-94459 (GCVE-0-2026-94459)

Vulnerability from cvelistv5 – Published: 2026-11-04 09:11 – Updated: 2026-11-04 09:11 X_Cemea X_Iris X_Ips X_Subsidiary

Title

IRISPowerscan Default accounts with predictable credentials

Summary

IRISPowerscan contain default user accounts with predictable credentials. An unauthenticated attacker with access to an affected installation could use these credentials to authenticate to the application and access functionality available to the affected accounts, potentially resulting in unauthorised access or modification of application data and configuration.

Severity

7.2 (High)


                        
                          CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

CWE

CWE-1392 - Use of default credentials

Assigner

Canon_EMEA CNA under the mitre root

CNA scorecard – unranked: 5 records in the last 180 days, 10 needed details

References

1 reference

URL	Tags
https://www.canon-europe.com/psirt/advisory-information	vendor-advisorymitigationpatch

Impacted products

1 product

Vendor	Product	Version
I.R.I.S S.A.	IRISPowerscan	Affected: 0 , ≤ 12.3 (custom)

Credits

Paul van der Haas working with Orange Cyberdefense

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "IRISPowerscan",
          "vendor": "I.R.I.S S.A.",
          "versions": [
            {
              "lessThanOrEqual": "12.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Paul van der Haas working with Orange Cyberdefense"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IRISPowerscan contain\ndefault user accounts with predictable credentials. An unauthenticated attacker\nwith access to an affected installation could use these credentials to\nauthenticate to the application and access functionality available to the\naffected accounts, potentially resulting in unauthorised access or modification\nof application data and configuration."
            }
          ],
          "value": "IRISPowerscan contain\ndefault user accounts with predictable credentials. An unauthenticated attacker\nwith access to an affected installation could use these credentials to\nauthenticate to the application and access functionality available to the\naffected accounts, potentially resulting in unauthorised access or modification\nof application data and configuration."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Not applicable"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1392",
              "description": "CWE-1392 Use of default credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T09:11:26.699Z",
        "orgId": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3",
        "shortName": "Canon_EMEA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "mitigation",
            "patch"
          ],
          "url": "https://www.canon-europe.com/psirt/advisory-information"
        }
      ],
      "source": {
        "advisory": "CPE2026-057",
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_cemea",
        "x_iris",
        "x_ips",
        "x_subsidiary"
      ],
      "title": "IRISPowerscan Default accounts with predictable credentials",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3",
    "assignerShortName": "Canon_EMEA",
    "cveId": "CVE-2026-94459",
    "datePublished": "2026-11-04T09:11:26.699Z",
    "dateReserved": "2026-09-21T17:17:19.496Z",
    "dateUpdated": "2026-11-04T09:11:26.699Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

6 vulnerabilities by I.R.I.S S.A.

CVE-2026-95649 (GCVE-0-2026-95649)

CVE-2026-94460 (GCVE-0-2026-94460)

CVE-2026-94459 (GCVE-0-2026-94459)

CVE-2026-95649 (GCVE-0-2026-95649)

CVE-2026-94460 (GCVE-0-2026-94460)

CVE-2026-94459 (GCVE-0-2026-94459)