{"id":"CVE-2026-95649","state":"PUBLISHED","title":"IRISPowerscan Insufficient restriction of untrusted scripts allows arbitrary code execution","description":"IRISPowerscan insufficiently restrict the use of\nuntrusted scripts. An authenticated user with access to script functionality\ncan import or modify scripts that are executed by the application, potentially\nresulting in arbitrary code execution in the security context of the Windows\nuser running IRISPowerscan.","publishedAt":"2026-11-04T09:14:14.423Z","updatedAt":"2026-11-04T09:14:14.423Z","severity":{"score":6.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N","source":"Canon_EMEA"},"assigner":"Canon_EMEA","products":["I.R.I.S S.A. IRISPowerscan"],"affected":[{"vendor":"I.R.I.S S.A.","product":"IRISPowerscan","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"12.3","versionType":"custom"}],"platforms":["Windows"]}],"references":["https://www.canon-europe.com/psirt/advisory-information"],"weaknesses":["CWE-829"],"ingestedAt":"2026-11-04T09:18:06.682Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/95xxx/CVE-2026-95649.json","commit":"8c5c8784c4dcac8f74c3312160cebad85d285b85","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-95649","state":"PUBLISHED","datePublished":"2026-11-04T09:14:14.423Z","dateUpdated":"2026-11-04T09:14:14.423Z","assignerShortName":"Canon_EMEA","assignerOrgId":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","dateReserved":"2026-09-22T11:58:00.080Z"},"containers":{"cna":{"title":"IRISPowerscan Insufficient restriction of untrusted scripts allows arbitrary code execution","descriptions":[{"lang":"en","value":"IRISPowerscan insufficiently restrict the use of\nuntrusted scripts. An authenticated user with access to script functionality\ncan import or modify scripts that are executed by the application, potentially\nresulting in arbitrary code execution in the security context of the Windows\nuser running IRISPowerscan."}],"affected":[{"vendor":"I.R.I.S S.A.","product":"IRISPowerscan","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"12.3","versionType":"custom"}],"platforms":["Windows"]}],"references":[{"url":"https://www.canon-europe.com/psirt/advisory-information","tags":["vendor-advisory","mitigation","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"ADJACENT","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"MEDIUM","baseScore":6.1,"vectorString":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-829","lang":"en","description":"CWE-829 Inclusion of functionality from untrusted control sphere","type":"CWE"}]}],"providerMetadata":{"shortName":"Canon_EMEA","orgId":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","dateUpdated":"2026-11-04T09:14:14.423Z"},"impacts":[{"descriptions":[{"lang":"en","value":"Not applicable"}]}],"tags":["x_cemea","x_iris","x_ips","x_subsidiary"],"credits":[{"lang":"en","value":"Paul van der Haas working with Orange Cyberdefense","type":"finder"}],"source":{"advisory":"CPE2026-057","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.5"}}}}}