Zephyr’s WireGuard implementation permits a replayed packet to alter peer state before anti‑replay validation, allowing an attacker to redirect the peer endpoint to a spoofed address and cause traffic hijacking. Because the packet decrypts successfully, the attack requires only interception of one valid ciphertext and re‑injection, producing a compromise of session integrity and availability. The flaw stems from improper ordering of operations, classified as CWE‑294: Decryption and Replay Validation Order Failure.

The affected product is Zephyr Project’s Zephyr RTOS networking subsystem, specifically the WireGuard data plane. Any Zephyr build prior to commit 260c32ef9a89824bd25e17170e77aa4b98c84069 is vulnerable. No explicit version range is provided; the patch is included in later releases.

The CVSS score of 6.5 denotes medium severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack can be performed by any adversary who can intercept traffic on the WireGuard tunnel and replay the cipher text from an arbitrary source address. No credentials or privileged access are required; the exploit relies solely on the WireGuard UDP dispatch. Consequently, the risk is significant for deployments with roaming enabled or where source address validation is lax.