The flaw in wolfProvider causes the 8‑byte explicit AES‑GCM nonce to be generated once when the TLS write key is set and never incremented for subsequent records. This means every TLS 1.2 or DTLS 1.2 AES‑GCM packet within a session is encrypted with the same key‑nonce pair, violating GCM security requirements and exposing the keystream. An attacker who observes two ciphertexts from the same connection can recover the plaintexts and forge authentication tags, compromising confidentiality and integrity of all data transmitted in that session.

wolfSSL Inc.'s wolfProvider library is affected. All releases earlier than version 1.2.2 exhibit the nonce‑reuse flaw for TLS 1.2 and DTLS 1.2 AES‑GCM traffic. Non‑TLS use of the cipher and the AES‑CCM mode are not impacted, and TLS 1.3 traffic is fully protected.

The CVSS score of 7.4 signals a moderate‑to‑high risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must have the ability to capture multiple records from a TLS session. The likely attack vector is passive network traffic observation; once two ciphertexts are available, the attacker can exploit the nonce reuse to recover plaintexts and forge authentication tags.