wolfEngine before version 1.4.1 derives the explicit AES‑CCM nonce for TLS 1.2 and DTLS 1.2 records from the record input buffer rather than the TLS sequence number. The result is that every record in a connection is encrypted with the same key/nonce pair, producing an identical keystream. This reuse allows a known plaintext record to reveal the keystream, which can decrypt all other records, and enables authentication tag forgery, breaking integrity. The vulnerability therefore poses a simultaneous confidentiality and integrity risk for any TLS 1.2 or DTLS 1.2 traffic protected with AES‑CCM.

The flaw affects wolfSSL Inc.’s wolfEngine product only; wolfProvider is not impacted. All releases prior to 1.4.1 are vulnerable. The issue only surfaces when AES‑CCM cipher suites are explicitly enabled on a TLS 1.2 or DTLS 1.2 connection, and it does not affect TLS 1.3 or non‑TLS use of the cipher. Because AES‑CCM suites are not enabled by default, exposure is limited to configurations that deliberately select them.

The CVSS score of 6.5 indicates moderate severity; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation. The likely attack vector is remote: an adversary who can establish TLS 1.2/DTLS 1.2 connections with a server that has AES‑CCM enabled could exploit the nonce reuse to recover encrypted data and forge integrity tags. Because the vulnerable behavior requires explicit cipher suite selection, the attack surface is narrower than a blind default issue, but systems that have enabled AES‑CCM are still at risk until mitigated.