A TLS 1.2 or DTLS 1.2 client that implements the wolfSSL library can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. At that moment no master secret has been derived, so the client installs read keys derived from a deterministic key and validates the server’s Finished message against that same key. An attacker can therefore insert an out‑of‑order ChangeCipherSpec in the handshake and complete the handshake in place of the real server, causing the client to accept data that the attacker has sent as authentic. The client’s outgoing traffic still uses properly derived keys, so the client cannot read the attacker’s data and the genuine server never completes a handshake. In DTLS 1.2 clients the out‑of‑order packet can be delivered by normal datagram delivery, while in TLS 1.2 clients the attacker must supply the bytes via wolfSSL_inject() or enable read‑ahead. For certificate‑based suites a man‑in‑the‑middle position is necessary, whereas for PSK connections any fake server can succeed without knowing the PSK.

The vulnerability affects the wolfSSL library, used by any application that implements TLS 1.2 or DTLS 1.2 clients built with this library. No specific version range is cited, so all current releases that allow early ChangeCipherSpec acceptance are potentially affected.

The vulnerability carries a CVSS score of 6.3, indicating a moderate severity. The EPSS score is not available, so the likelihood of exploitation is unknown, but the attack requires the attacker to be able to inject records – either by exploiting DTLS datagram reordering or by acting as a man‑in‑the‑middle in TLS. The vulnerability is not listed in the CISA KEV catalog. Because the attacker can impersonate the server and send data accepted by the client, there is a real risk of authentication bypass, but the client cannot read the attacker’s data, limiting potential damage. The risk is higher for deployments that use PSK connections or enable read‑ahead, and lower for strictly certificate‑based connections with no MITM.