What’s Vulnerable › Vulnerabilities

CVE-2022-26320

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-14 · updated 2026-06-17
• Weakness: CWE-330

Description

The Rambus SafeZone Basic Crypto Module before 10.4.0, as used in certain Fujifilm (formerly Fuji Xerox) devices before 2022-03-01, Canon imagePROGRAF and imageRUNNER devices through 2022-03-14, and potentially many other devices, generates RSA keys that can be broken with Fermat's factorization method. This allows efficient calculation of private RSA keys from the public key of a TLS certificate.

Affected products

• Canon Imageprograf Firmware: before 2020-03-14 — fixed in 2020-03-14
• Canon Imagerunner Firmware: through 2020-03-14
• Fujifilm Apeos C3070 Firmware: before 1.1.7 — fixed in 1.1.7
• Fujifilm Apeos C3070 G Firmware: before 1.1.7 — fixed in 1.1.7
• Fujifilm Apeos C325 Dw Firmware: before 202112062053 — fixed in 202112062053
• Fujifilm Apeos C325 Z Firmware: before 202112062053 — fixed in 202112062053
• Fujifilm Apeos C328 Df Firmware: before 202112062053 — fixed in 202112062053
• Fujifilm Apeos C328 Dw Firmware: before 202112062053 — fixed in 202112062053
• Fujifilm Apeos C3570 Firmware: before 1.1.7 — fixed in 1.1.7
• Fujifilm Apeos C3570 G Firmware: before 1.1.7 — fixed in 1.1.7
• Fujifilm Apeos C4570 Firmware: before 1.1.7 — fixed in 1.1.7
• Fujifilm Apeos C4570 G Firmware: before 1.1.7 — fixed in 1.1.7
• Fujifilm Apeos C5570 Firmware: before 1.1.7 — fixed in 1.1.7
• Fujifilm Apeos C5570 G Firmware: before 1.1.7 — fixed in 1.1.7
• Fujifilm Apeos C6570 Firmware: before 1.1.7 — fixed in 1.1.7
• Fujifilm Apeos C6570 G Firmware: before 1.1.7 — fixed in 1.1.7
• Fujifilm Apeos C6580 Firmware: before 1.1.6 — fixed in 1.1.6
• Fujifilm Apeos C7070 Firmware: before 1.1.7 — fixed in 1.1.7
• Fujifilm Apeos C7070 G Firmware: before 1.1.7 — fixed in 1.1.7
• Fujifilm Apeos C7580 Firmware: before 1.1.6 — fixed in 1.1.6
• Fujifilm Apeos C8180 Firmware: before 1.1.6 — fixed in 1.1.6
• Fujifilm Apeosport-Vii 4021 Firmware: before 1.60.9 — fixed in 1.60.9
• Fujifilm Apeosport-Vii 5021 Firmware: before 1.60.9 — fixed in 1.60.9
• Fujifilm Apeosport-Vii C2273 Firmware: before 1.60.2 — fixed in 1.60.2
• Fujifilm Apeosport-Vii C3321 Firmware: before 1.60.9 — fixed in 1.60.9
• Fujifilm Apeosport-Vii C3372 Firmware: before 1.60.2 — fixed in 1.60.2
• Fujifilm Apeosport-Vii C3373 Firmware: before 1.60.2 — fixed in 1.60.2
• Fujifilm Apeosport-Vii C4421 Firmware: before 1.60.9 — fixed in 1.60.9
• Fujifilm Apeosport-Vii C4473 Firmware: before 1.60.2 — fixed in 1.60.2
• Fujifilm Apeosport-Vii C5573 Firmware: before 1.60.2 — fixed in 1.60.2

How to fix

Upgrade to a fixed version: Canon Imageprograf Firmware 2020-03-14; Fujifilm Apeos C3070 Firmware 1.1.7; Fujifilm Apeos C3070 G Firmware 1.1.7; Fujifilm Apeos C325 Dw Firmware 202112062053; Fujifilm Apeos C325 Z Firmware 202112062053; Fujifilm Apeos C328 Df Firmware 202112062053; Fujifilm Apeos C328 Dw Firmware 202112062053; Fujifilm Apeos C3570 Firmware 1.1.7; Fujifilm Apeos C3570 G Firmware 1.1.7; Fujifilm Apeos C4570 Firmware 1.1.7; Fujifilm Apeos C4570 G Firmware 1.1.7; Fujifilm Apeos C5570 Firmware 1.1.7. Check the vendor advisory for mitigations.

References

• https://fermatattack.secvuln.info
• https://global.canon/en/support/security/index.html
• https://web.archive.org/web/20220922042721/https://safezoneswupdate.com/
• https://www.fujifilm.com/fbglobal/eng/company/news/notice/2022/0302_rsakey_announce.html
• https://www.rambus.com/security/response-center/advisories/rmbs-2021-01/
• https://fermatattack.secvuln.info
• https://global.canon/en/support/security/index.html
• https://safezoneswupdate.com
• https://www.fujifilm.com/fbglobal/eng/company/news/notice/2022/0302_rsakey_announce.html

Get alerted when CVE-2022-26320 or the next vulnerability affects your stack