Technical impact
The wg(4) driver for FreeBSD omits a critical MAC verification step after decrypting packets, accepting any Poly1305 tag without checking it. This flaw enables an attacker to craft and send packets that appear to be authenticated, enabling tampering or injection of arbitrary data into the tunnel. The vulnerability directly impacts the integrity of communications over WireGuard and can potentially expose sensitive data or allow remote modification of traffic destined for the host.
Affected Systems
The issue affects the WireGuard driver in FreeBSD operating systems. Any device running a FreeBSD release that uses the wg(4) interface for VPN connectivity is vulnerable unless updated to a patched kernel version provided by the vendor.
Risk and Exploitability
The EPSS score is reported as less than 1%, indicating an overall low probability of exploitation at the current time, and the vulnerability is not listed in CISA's KEV catalog. Nevertheless, the flaw is remote and does not require privilege escalation; an attacker who can send or intercept UDP traffic to the WireGuard endpoint can exploit the flaw. The attacker can guess the replay window bounds to successfully inject forged or modified transport packets. The CVSS score is 7.5, but the potential impact on confidentiality, integrity, and availability of VPN traffic should be considered significant given that authentication is bypassed.
