CVE-2021-20872

MEDIUM

6.8

CVSS Score

Published: January 4, 2022 at 03:05 AM UTC

Updated: June 17, 2026 at 03:34 AM UTC

105 products affected across 1 vendorBizhub C659 FirmwareBizhub C558 FirmwareBizhub C458 Firmware

Using bizhub series by KONICA MINOLTA, INC.?

Get instant alerts when new vulnerabilities affect bizhub series - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.8

Exploit prediction

EPSS 0.3%

Description

Protection mechanism failure vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C550i/C450i G00-B6 and earlier, bizhub C360i/C300i/C250i G00-B6 and earlier, bizhub 750i/650i/550i/450i G00-37 and earlier, bizhub 360i/300i G00-33 and earlier, bizhub C287i/C257i/C227i G00-19 and earlier, bizhub 306i/266i/246i/226i G00-B6 and earlier, bizhub C759/C659 GC7-X8 and earlier, bizhub C658/C558/C458 GC7-X8 and earlier, bizhub 958/808/758 GC7-X8 and earlier, bizhub 658e/558e/458e GC7-X8 and earlier, bizhub C287/C227 GC7-X8 and earlier, bizhub 287/227 GC7-X8 and earlier, bizhub 368e/308e GC7-X8 and earlier, bizhub C368/C308/C258 GC9-X4 and earlier, bizhub 558/458/368/308 GC9-X4 and earlier, bizhub C754e/C654e GDQ-M0 and earlier, bizhub 754e/654e GDQ-M0 and earlier, bizhub C554e/C454e GDQ-M1 and earlier, bizhub C364e/C284e/C224e GDQ-M1 and earlier, bizhub 554e/454e/364e/284e/224e GDQ-M1 and earlier, bizhub C754/C654 C554/C454 GR1-M0 and earlier, bizhub C364/C284/C224 GR1-M0 and earlier, bizhub 754/654 GR1-M0 and earlier, bizhub C3851FS/C3851/C3351 GC9-X4 and earlier, bizhub 4752/4052 GC9-X4 and earlier) allows a physical attacker to bypass the firmware integrity verification and to install malicious firmware.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Bizhub 224E Firmware · Konicaminolta

95%

v < gdr-m1

Affected range stops below gdr-m1, so it looks safe — our inference, not a vendor statement

konicaminolta-bizhub-224e (same device)

Bizhub 227 Firmware · Konicaminolta

95%

v < gca-y0

Affected range stops below gca-y0, so it looks safe — our inference, not a vendor statement

konicaminolta-bizhub-227 (same device)

Bizhub 284E Firmware · Konicaminolta

95%

v < gdr-m1

Affected range stops below gdr-m1, so it looks safe — our inference, not a vendor statement

konicaminolta-bizhub-284e (same device)

Bizhub 287 Firmware · Konicaminolta

95%

v < gca-y0

Affected range stops below gca-y0, so it looks safe — our inference, not a vendor statement

konicaminolta-bizhub-287 (same device)

Bizhub 308 Firmware · Konicaminolta

95%

v < gca-x4

Affected range stops below gca-x4, so it looks safe — our inference, not a vendor statement

konicaminolta-bizhub-308 (same device)

Bizhub 308E Firmware · Konicaminolta

95%

v < gca-x8

Affected range stops below gca-x8, so it looks safe — our inference, not a vendor statement

konicaminolta-bizhub-308e (same device)

Bizhub 364E Firmware · Konicaminolta

95%

v < gdr-m1

Affected range stops below gdr-m1, so it looks safe — our inference, not a vendor statement

konicaminolta-bizhub-364e (same device)

Bizhub 368 Firmware · Konicaminolta

95%

v < gca-x4

Affected range stops below gca-x4, so it looks safe — our inference, not a vendor statement

konicaminolta-bizhub-368 (same device)

Bizhub 368E Firmware · Konicaminolta

95%

v < gca-x8

Affected range stops below gca-x8, so it looks safe — our inference, not a vendor statement

konicaminolta-bizhub-368e (same device)

Bizhub 4052 Firmware · Konicaminolta

95%

v < gca-x4

Affected range stops below gca-x4, so it looks safe — our inference, not a vendor statement

konicaminolta-bizhub-4052 (same device)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (4)

x_refsource_MISCThird Party AdvisoryVDB Entry

Source: [email protected]

https://jvn.jp/en/vu/JVNVU95192472/index.html

x_refsource_MISCThird Party AdvisoryVDB Entry

Source: [email protected]

https://jvn.jp/vu/JVNVU95192472/index.html

x_refsource_MISCMitigationVendor Advisory

Source: [email protected]

https://www.konicaminolta.com/global/newsroom/topics/2021/1224-01-01.html

x_refsource_MISCMitigationVendor Advisory

Source: [email protected]

https://www.konicaminolta.jp/business/support/important/211224_01_01.html

CVSS

6.8MEDIUM[email protected]

Attack Vector: PHYSICAL
Complexity: LOW
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

NVD-CWE-Other

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card