Vulnerability · Published Mar 14, 2022 · Assigned by mitre
CVE-2022-26320
Critical 9.1
In plain English
A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).
Severity (CVSS NVD)9.1Critical
Exploit odds (30 days)1.0%top 37.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Rambus SafeZone Basic Crypto Module before 10.4.0, as used in certain Fujifilm (formerly Fuji Xerox) devices before 2022-03-01, Canon imagePROGRAF and imageRUNNER devices through 2022-03-14, and potentially many other devices, generates RSA keys that can be broken with Fermat's factorization method. This allows efficient calculation of private RSA keys from the public key of a TLS certificate.
Affected products (as reported)
References
- https://global.canon/en/support/security/index.html
- https://fermatattack.secvuln.info
- https://www.fujifilm.com/fbglobal/eng/company/news/notice/2022/0302_rsakey_announce.html
- https://www.rambus.com/security/response-center/advisories/rmbs-2021-01/
- https://web.archive.org/web/20220922042721/https://safezoneswupdate.com/
- https://safezoneswupdate.com x_refsource_MISC, x_transferred