Regarding Measure against RSA Key Generation Vulnerability for Enterprise/Small Office Multifunction Printers and Laser Printers/Inkjet Printers - Canon HongKong

Thank you for using Canon products.

A vulnerability affecting Cryptographic library’s RSA Key generation in Canon’s Enterprise/Small Office Multifunction Printers and Laser Printers/Inkjet Printers has been confirmed. (CVE-2022-26320）

This vulnerability may allow efficient calculation of private RSA key from the public key of a TLS certificate due to incorrect generation process of RSA key pair.  If an RSA key pair generated by a Cryptographic library affected by this vulnerability is used for TLS or IPSec, such RSA public key could be exploited by third party and render the certificate invalid.

There have been no reports of damage relating to this vulnerability. However, to enhance the security of the product, we advise customers to install the latest firmware available for the affected products mentioned below.

In case an RSA key pair is generated by an affected Cryptographic library, additional steps are required after firmware upgrade. Please see below for detailed steps.

We also recommend customers to set a private IP address for the products and create a network environment with a firewall or Wi-Fi router that can restrict network access.

For more details on “Securing products when connecting to a network, please visit here.

We will continue to update customers on any vulnerability detected in other products.

Affected Products:

Support:
Enterprise/Small Office Multifunction Printers
Please contact your nearest service center

Inkjet Printers
Please contact your nearest service center

Large Format Printers
Please contact your nearest service center

First Posted on 15 Mar 2022