CVE-2022-26320: canon imageprograf_firmware Use of Insufficiently Random Values
Vulnerability summary
CVE-2022-26320 is a critical (CVSS 9.1) Use of Insufficiently Random Values vulnerability in canon imageprograf_firmware. EPSS estimates a 0.97% chance of exploitation in the next 30 days, higher than 61.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Duplicates 1Timeline
- 14-03-2022PublishedVulnerability first disclosed.
- 07-10-2024Last modifiedVulnerability information updated.
Description
The Rambus SafeZone Basic Crypto Module before 10.4.0, as used in certain Fujifilm (formerly Fuji Xerox) devices before 2022-03-01, Canon imagePROGRAF and imageRUNNER devices through 2022-03-14, and potentially many other devices, generates RSA keys that can be broken with Fermat's factorization method. This allows efficient calculation of private RSA keys from the public key of a TLS certificate.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.97%
Chance of exploitation in the next 30 days
Percentile
62%
Versus all other CVEs
30-day change
0.00 pp
From 0.97% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Fujifilm89 products
- apeos_c3070_firmware< 1.1.7
- apeos_c3070_g_firmware< 1.1.7
- apeos_c325_dw_firmware< 202112062053
- apeos_c325_z_firmware< 202112062053
- apeos_c328_df_firmware< 202112062053
Canon2 products
- imageprograf_firmware< 2020-03-14
- imagerunner_firmware≤ 2020-03-14
Rambus1 product
- safezone_basic_crypto_module≥ 9.3.0, < 10.4.0
3 vendors · 92 products
References
6 links- global.canon/en/support/security/index.htmlThird Party Advisory
- fermatattack.secvuln.infoThird Party Advisory
- www.fujifilm.com/fbglobal/eng/company/news/notice/2022/0302_rsakey_announce.htmlMitigationThird Party Advisory