The vulnerability in WolfEngine before version 1.4.1 causes the AES‑GCM explicit nonce to be reused for every TLS 1.2 / DTLS 1.2 record. Because the nonce and key pair remain identical, the keystream is reused and the authentication tag is no longer unique. An attacker who can observe two or more ciphertexts from the same connection can XOR the ciphertexts to recover the keystream, recover the plaintext of other records, and forge authentication tags, thereby compromising confidentiality and integrity.

Affected products are the WolfEngine library from wolfSSL Inc., specifically all versions released prior to 1.4.1 that use the RSA/TLS 1.2 or DTLS 1.2 AES‑GCM cipher suite. The issue is not present in versions 1.4.1 and later, nor in configurations that use AES‑CCM, TLS 1.3, or non‑TLS AES‑GCM.

The CVSS score of 7.4 reflects a high severity impact. No EPSS score is available, and the vulnerability is not catalogued in CISA KEV, suggesting limited public exploitation data. However, the attack requires an active connection that exchanges multiple TLS records; it can be performed remotely over any TLS 1.2 or DTLS 1.2 server using AES‑GCM. Because the nonce reuse does not depend on privileged access, a determined adversary could exploit the vulnerability by simply intercepting traffic to a vulnerable endpoint.