Zephyr WireGuard CVE-2026-13734

Two concrete prerequisites must both be satisfied. First, the attacker must be on-path or on a shared medium relative to the WireGuard session - capable of passively capturing at least one valid encrypted MESSAGE_TRANSPORT_DATA datagram from the legitimate peer; a purely off-path attacker cannot supply the required authentic ciphertext. Second, the target node must be running Zephyr RTOS with the WireGuard subsystem compiled in and an active WireGuard session established (idle peers with no active session have no traffic to capture). No authentication credentials are required once a valid ciphertext is captured, because the handler processes inbound UDP datagrams based solely on the receiver keypair index. Limiting factors: the attack window is transient - the legitimate peer's next packet re-corrects the hijacked endpoint - so persistent redirection requires continuous replays; the attacker gains traffic redirection only (outbound packets from the victim to the attacker's address), not decryption of tunnel payload; and the attack does not apply to WireGuard implementations on other platforms (Linux, Windows, etc.), only to the Zephyr subsystem.

The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H, score 6.5) accurately reflects the attack profile: network-reachable and requiring no credentials, but gated behind a High complexity prerequisite - the attacker must occupy an on-path or shared-medium position to capture a valid ciphertext before replaying it. No KEV listing is present and no public exploit has been identified at time of analysis, so real-world exploitation is not confirmed. The RCE tag attached to this CVE in the source data is contradicted by both the description and the fix diff, which explicitly confirm no payload decryption occurs; defenders should classify this as a traffic-redirection and session-disruption vulnerability, not code execution. The High availability rating is justified by premature keypair destruction, which forces a costly handshake to re-establish the session; the Low integrity rating reflects that the endpoint hijack is transient - the legitimate peer's next authenticated packet re-corrects the roaming state. The net risk is meaningful for IoT environments where WireGuard tunnels carry control-plane or telemetry traffic and where network adjacency is a realistic threat model (e.g., shared cellular APNs, LTE network slices, or campus Wi-Fi), but low for deployments where WireGuard peers communicate over dedicated, monitored links with no realistic on-path adversary.

An attacker positioned on a shared Wi-Fi network or compromised router between two WireGuard peers passively captures a single valid MESSAGE_TRANSPORT_DATA UDP datagram from the legitimate peer. The attacker re-transmits the unchanged ciphertext with a spoofed source IP and port pointing to an attacker-controlled address; Zephyr's handler decrypts it successfully (the AEAD tag is still valid), updates the peer endpoint to the attacker's address, destroys the previous keypair, and refreshes liveness timers before the replay check fires and returns an error. The victim node's subsequent outbound WireGuard packets are then forwarded to the attacker's address until the legitimate peer sends its next authenticated packet to re-correct the roaming state.