Zephyr RTOS EUVD-2026-67947

Exploitation requires an active WireGuard session on the target Zephyr device with a non-expired peer keypair for the targeted receiver index - without a live session, get_peer_keypair_for_index() will fail and the message is dropped before the vulnerable early-return path. An on-path attacker obtains the receiver index by observing cleartext WireGuard handshake or data traffic; an off-path attacker must brute-force the 32-bit index space (approximately 4 billion values) against the WireGuard UDP port while a valid session is active, which is resource-intensive but not computationally infeasible. The Zephyr WireGuard subsystem must be compiled and enabled in the firmware build. Exploitation is strictly limited to spoofing NET_EVENT_VPN_CONNECTED and incrementing keepalive statistics; it does not enable plaintext decryption, traffic injection, peer endpoint update, session key disclosure, or availability impact.

The vendor-assigned CVSS 3.1 score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) is well-calibrated to the actual impact. The High Attack Complexity (AC:H) reflects the off-path brute-force requirement or on-path observation prerequisite; PR:N accurately captures that no session credentials are required - only knowledge of the receiver index. The impact ceiling of I:L reflects that the only consequence is a spoofed NET_EVENT_VPN_CONNECTED management event and an incremented keepalive-RX counter, with no effect on liveness timers, peer endpoint state, or actual network traffic. No EPSS score, CISA KEV listing, or public POC was available in the provided data, so exploitation status cannot be assessed quantitatively. Real-world risk is primarily elevated in Zephyr-based embedded systems where the NET_EVENT_VPN_CONNECTED event drives downstream access-control or network-policy logic - in those deployments, a false 'connected' signal could cause a device to trust a VPN path that was never cryptographically established. Outside that narrow application pattern, the practical impact is negligible.

An attacker positioned on the same network path as a Zephyr device running WireGuard passively observes the cleartext 32-bit receiver index from a legitimate WireGuard handshake or data packet. The attacker then crafts a 16-byte UDP payload - a garbage 16-byte buffer - addressed to the WireGuard port with that receiver index, which the unpatched device accepts without performing any Poly1305 tag verification, causing it to emit a spoofed NET_EVENT_VPN_CONNECTED event and update keepalive statistics, potentially misleading application logic that gates network access on VPN connectivity state.