The WireGuard implementation in Zephyr updates a peer’s endpoint using data from an unverified transport‑data message. When an incoming datagram’s receiver index does not match any existing session, the code copies the packet’s source address into the peer structure without authentication, allowing an attacker to redirect the peer’s endpoint to an arbitrary address. As a result, all subsequent handshakes and data packets are sent to the attacker’s chosen host, breaking the connection for legitimate peers. Although the encryption remains secure, the tunnel becomes unavailable and attackers can observe traffic metadata and selectively drop packets, leading to loss of availability and limited confidentiality.

Zephyr RTOS running the experimental WireGuard module (CONFIG_WIREGUARD). The vulnerability affects systems where UDP port 51820 is exposed and the WireGuard listener is active. No specific product version information is provided; the issue exists in the current Zephyr code base until a patch removes the unauthenticated endpoint learning.

With a CVSS score of 8.2, this flaw is considered high severity. The EPSS score is not available, but the flaw is trivially exploitable from any host capable of sending UDP traffic to the default WireGuard port. No authentication or prior session is required, enabling off‑path hijack. KEV status is not listed. An attacker can fabricate a single 16‑byte datagram to hijack the endpoint, controlling future traffic and causing a denial of service for the legitimate peer.