The vulnerability allows certificates that use SHA‑1 or MD5 hash algorithms to be accepted by the wolfSSL library, in violation of current cryptographic standards. This weakens authentication and opens the door for attackers to create forged certificates, potentially enabling man‑in‑the‑middle attacks. The weakness is classified as CWE‑327.

The issue affects all wolfSSL library deployments that have not updated to a version where SHA‑1/MD5 certificate processing has been disabled. No specific product version is listed in the admission, but any application utilizing wolfSSL for TLS may be impacted. Some embedded systems, IoT devices, and other software that rely on wolfSSL for secure communications could be susceptible until a patch is applied.

The CVSS score of 2.3 indicates a low severity, and no exploit is known. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Attackers would need the ability to supply a forged certificate or manipulate the certificate chain presented to an application using wolfSSL. If such an input path exists, they could potentially subvert identity verification. The potential impact exists only where legacy hashes have not been disabled by configuration or code changes.