EUVD-2026-67738
GHSA-vf9h-5c79-c2xp
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Passive network eavesdropping requires no privileges (PR:N) but depends on non-default AES-CCM selection and multi-record observation (AC:H); integrity impact is limited to tag forgery (I:L) with no availability effect.
Primary rating from Vendor (wolfSSL).
CVSS VectorVendor: wolfSSL
Lifecycle Timeline
1DescriptionCVE.org
wolfEngine before 1.4.1 sources the explicit AES-CCM nonce for TLS 1.2 and DTLS 1.2 records from the record input buffer instead of the TLS sequence number carried in the additional authenticated data. Because the record layer leaves the explicit-nonce field for the cipher to populate, the value read is constant across records, so every AES-CCM record within a connection is encrypted under an identical key and nonce pair. Reusing a CCM key and nonce weakens confidentiality (identical keystream across records, so a known record recovers the others) and integrity (authentication tag forgery). Only wolfEngine is affected; wolfProvider is not. AES-GCM under wolfEngine is tracked separately. AES-CCM cipher suites are not enabled by default and must be explicitly selected, which limits exposure. TLS 1.3 and non-TLS use of the cipher are not affected.
AnalysisAI
Nonce reuse in wolfEngine's AES-CCM implementation for TLS 1.2 and DTLS 1.2 allows a network-positioned adversary to recover plaintext across records and forge authentication tags within a session. The root defect is that wolfEngine reads the explicit CCM nonce from the uninitialized record input buffer rather than deriving it from the TLS sequence number in the Additional Authenticated Data, producing a constant nonce for every record under the same key. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following to be true simultaneously: the target is using wolfEngine (not wolfProvider) as its OpenSSL engine; the TLS session is TLS 1.2 or DTLS 1.2 (TLS 1.3 is not affected); an AES-CCM cipher suite has been explicitly selected in the configuration - AES-CCM is not enabled by default in wolfEngine and must be actively opted into, meaning this flaw cannot be triggered against default configurations; and the attacker is network-positioned to observe and collect multiple encrypted records from the same connection. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) is well-calibrated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade wolfEngine to version 1.4.1 or later, which corrects the nonce sourcing to use the TLS sequence number from the AAD as required by RFC 6655. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wolfengine
View allSame weakness CWE-323 – Reusing a Nonce, Key Pair in Encryption
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today