Description
Zephyr's WireGuard implementation in subsys/net/lib/wireguard/wg_crypto.c mishandled keepalive packets. In wg_process_data_message(), any type-4 transport-data message whose payload was exactly 16 bytes (an empty plaintext plus a bare Poly1305 tag, i.e. a keepalive) was accepted and returned immediately, before wg_decrypt_packet() was ever called. The Poly1305 authentication tag was therefore never verified; the only preceding gates were a cleartext receiver-index lookup (get_peer_keypair_for_index() on the attacker-supplied data_hdr->receiver) and a non-cryptographic keypair validity/expiry check.

The path is reachable entirely from the network: inbound UDP on the WireGuard port is dispatched by wg_input() to handle_transport_data() and then wg_process_data_message(). The 32-bit receiver index is transmitted in cleartext in WireGuard handshake and data messages, so an on-path observer learns it directly and an off-path attacker can brute-force it against the UDP port. Given an active receiving-valid session for that index, an attacker could send a 16-byte garbage payload and have it accepted without possessing the session key.

On acceptance the unauthenticated message caused the management layer to observe a spoofed NET_EVENT_VPN_CONNECTED signal (setting peer->first_valid and notifying any net_mgmt listener) and incremented the keepalive-RX statistic. The impact is limited to integrity of this status signal: no plaintext is decrypted or injected, no key is disclosed, and the early-return path did not update the peer endpoint or liveness timers, so there is no traffic-injection, session-takeover, or availability consequence.

The fix removes the pre-decrypt early return so a 16-byte payload flows through wg_decrypt_packet(), which verifies the Poly1305 tag over the empty plaintext, followed by the existing anti-replay check; only an authenticated, non-replayed message is then recognised as a keepalive. Forged keepalives now fail the tag check and are counted as decrypt failures.
Published: 2026-08-28
Score: 3.7 Low
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is in Zephyr’s WireGuard stack, where the code accepts 16‑byte keep‑alive messages without verifying the Poly1305 authentication tag. The packet is read, a cleartext receiver index lookup is performed, and the message is immediately returned to the management layer before the decryption routine runs. The result is that an attacker can inject a forged NET_EVENT_VPN_CONNECTED signal and increment the keep‑alive counter without possessing the session key, thereby compromising only the integrity of the VPN connection status.

Affected Systems

Devices running the Zephyr RTOS that include the WireGuard networking stack, specifically any build containing the code in subsys/net/lib/wireguard/wg_crypto.c prior to the patch commit 87c520a55f0f0e7cd4adf8780166e45eaad6d81c.

Risk and Exploitability

The flaw is reachable over the network on the WireGuard UDP port and requires a valid 32‑bit receiver index, which can be learned from cleartext handshakes or brute‑forced. Once the session is valid, an attacker can send forged 16‑byte keep‑alive packets that bypass authentication and spur a spoofed connection event. The CVSS score of 3.7 indicates low severity; the EPSS score is unavailable and the vulnerability is not listed in CISA KEV. The impact is limited to the integrity of the state indicator, with no key disclosure, payload injection, or availability effect. The risk remains low but a recent fix is available and should be applied to eliminate the fault.

Generated by OpenCVE AI on August 28, 2026 at 23:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Zephyr patch referenced by commit 87c520a55f0f0e7cd4adf8780166e45eaad6d81c or upgrade to a Zephyr release that incorporates the fix.
  • Restrict the WireGuard UDP listening port to trusted peers using host or network firewall rules to reduce brute force attempts for the 32‑bit receiver index.
  • Configure net_mgmt logging or alerts for unexpected NET_EVENT_VPN_CONNECTED events to detect potential spoofing attempts.

Generated by OpenCVE AI on August 28, 2026 at 23:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Fri, 28 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Description Zephyr's WireGuard implementation in subsys/net/lib/wireguard/wg_crypto.c mishandled keepalive packets. In wg_process_data_message(), any type-4 transport-data message whose payload was exactly 16 bytes (an empty plaintext plus a bare Poly1305 tag, i.e. a keepalive) was accepted and returned immediately, before wg_decrypt_packet() was ever called. The Poly1305 authentication tag was therefore never verified; the only preceding gates were a cleartext receiver-index lookup (get_peer_keypair_for_index() on the attacker-supplied data_hdr->receiver) and a non-cryptographic keypair validity/expiry check. The path is reachable entirely from the network: inbound UDP on the WireGuard port is dispatched by wg_input() to handle_transport_data() and then wg_process_data_message(). The 32-bit receiver index is transmitted in cleartext in WireGuard handshake and data messages, so an on-path observer learns it directly and an off-path attacker can brute-force it against the UDP port. Given an active receiving-valid session for that index, an attacker could send a 16-byte garbage payload and have it accepted without possessing the session key. On acceptance the unauthenticated message caused the management layer to observe a spoofed NET_EVENT_VPN_CONNECTED signal (setting peer->first_valid and notifying any net_mgmt listener) and incremented the keepalive-RX statistic. The impact is limited to integrity of this status signal: no plaintext is decrypted or injected, no key is disclosed, and the early-return path did not update the peer endpoint or liveness timers, so there is no traffic-injection, session-takeover, or availability consequence. The fix removes the pre-decrypt early return so a 16-byte payload flows through wg_decrypt_packet(), which verifies the Poly1305 tag over the empty plaintext, followed by the existing anti-replay check; only an authenticated, non-replayed message is then recognised as a keepalive. Forged keepalives now fail the tag check and are counted as decrypt failures.
Title WireGuard keepalive transport-data messages accepted without Poly1305 authentication
Weaknesses CWE-290
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-08-28T20:38:50.695Z

Reserved: 2026-06-29T14:44:09.848Z

Link: CVE-2026-13735

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-28T22:16:46.187

Modified: 2026-08-28T22:16:46.187

Link: CVE-2026-13735

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-29T00:00:15Z

Weaknesses
  • CWE-290

    Authentication Bypass by Spoofing