CVE-2019-6000

CVE-2019-6000 is a buffer overflow vulnerability in the Picture Transfer Protocol (PTP) of numerous Canon EOS series digital cameras and select PowerShot models. An attacker on the same network segment can exploit this flaw by sending a crafted "sendhostinfo" command. This can lead to the affected device becoming unresponsive (denial of service) or allow for arbitrary code execution, posing a significant risk to data integrity and device control. The vulnerability has a CVSS v3 score of 8.8 (High), indicating a severe threat. It requires network access (AV:A) but has low attack complexity (AC:L) and no user interaction (UI:N), making it easily exploitable. Successful exploitation can result in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H). While there is no known active exploitation in the wild (KEV: No) and no public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community attention and media coverage, including demonstrations of ransomware attacks on affected cameras. This suggests a high potential for future exploitation.