# CVE-2022-26320: Weak cryptography in n/a

> Weak RSA key generation in printer firmware allows attackers to derive private keys and decrypt TLS traffic or impersonate devices.

- **Severity:** Critical 9.1 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** No
- **Published:** 14 Mar 2022
- **Updated:** 7 Oct 2024
- **Also known as:** CVE-2022-26351, GHSA-vgmm-r7wp-gmv8

## What is CVE-2022-26320?

CVE-2022-26320 is a critical vulnerability in n/a, published on 14 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

The Rambus SafeZone Basic Crypto Module before 10.4.0, as used in certain Fujifilm (formerly Fuji Xerox) devices before 2022-03-01, Canon imagePROGRAF and imageRUNNER devices through 2022-03-14, and potentially many other devices, generates RSA keys that can be broken with Fermat's factorization method. This allows efficient calculation of private RSA keys from the public key of a TLS certificate.

Weakness: CWE-330 (Use of Insufficiently Random Values)

## Which versions are affected by CVE-2022-26320?

It affects 92 products.


Products: Canon Imageprograf Firmware, Canon Imagerunner Firmware, Fujifilm Apeos C3070 Firmware, Fujifilm Apeos C3070 G Firmware, Fujifilm Apeos C325 Dw Firmware, Fujifilm Apeos C325 Z Firmware, Fujifilm Apeos C328 Df Firmware, Fujifilm Apeos C328 Dw Firmware, Fujifilm Apeos C3570 Firmware, Fujifilm Apeos C3570 G Firmware, Fujifilm Apeos C4570 Firmware, Fujifilm Apeos C4570 G Firmware, Fujifilm Apeos C5570 Firmware, Fujifilm Apeos C5570 G Firmware, Fujifilm Apeos C6570 Firmware, Fujifilm Apeos C6570 G Firmware, Fujifilm Apeos C6580 Firmware, Fujifilm Apeos C7070 Firmware, Fujifilm Apeos C7070 G Firmware, Fujifilm Apeos C7580 Firmware and 72 more.

## How do I fix CVE-2022-26320?

No fix has been published for CVE-2022-26320 yet. Limit exposure of the affected software until one is available.

## Is CVE-2022-26320 being exploited?

There is no known exploitation of CVE-2022-26320 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2022-26320 and fix it if it is affected.

What it is: CVE-2022-26320 is a critical vulnerability in n/a, published on 14 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2022-26320 in the wild and no public exploit code.

Affected product: n/a. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2022-26320/ (Markdown: https://insights.sbomify.com/CVE-2022-26320/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2022-26320
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-26320
- OSV: https://osv.dev/vulnerability/CVE-2022-26320

---
From sbomify Insights: https://insights.sbomify.com/CVE-2022-26320/
Summaries are generated and may contain mistakes; the official description above is the record.