Wg Easy
Monthly
Root-level OS command injection in wg-easy 15.3.0 lets a low-privileged web user holding the clients.create permission escalate to full host compromise. Because the client name is written verbatim into the WireGuard config, an attacker embeds newline-separated PostUp directives that wg-quick later executes as root. No public exploit identified at time of analysis, but the CVSS 9.9 (S:C, full C/I/A) and simple, GUI-driven injection make this a high-priority issue for any exposed wg-easy instance.
Peer credential disclosure in WireGuard Easy (wg-easy) through 15.3.0 lets unauthenticated network attackers recover a client's WireGuard PrivateKey and PresharedKey by brute-forcing the one-time configuration link. Because the OTL token is derived from CRC32 over a random value bounded to 0-999, an attacker faces at most 1000 candidate tokens per client ID against the unauthenticated /cnf/:oneTimeLink route, which had no rate limiting and did not enforce token expiration. There is no public exploit identified at time of analysis, but the small keyspace makes exploitation trivial once a valid link is active; the flaw was reported by VulnCheck and is fixed upstream.
Root-level OS command injection in wg-easy 15.3.0 lets a low-privileged web user holding the clients.create permission escalate to full host compromise. Because the client name is written verbatim into the WireGuard config, an attacker embeds newline-separated PostUp directives that wg-quick later executes as root. No public exploit identified at time of analysis, but the CVSS 9.9 (S:C, full C/I/A) and simple, GUI-driven injection make this a high-priority issue for any exposed wg-easy instance.
Peer credential disclosure in WireGuard Easy (wg-easy) through 15.3.0 lets unauthenticated network attackers recover a client's WireGuard PrivateKey and PresharedKey by brute-forcing the one-time configuration link. Because the OTL token is derived from CRC32 over a random value bounded to 0-999, an attacker faces at most 1000 candidate tokens per client ID against the unauthenticated /cnf/:oneTimeLink route, which had no rate limiting and did not enforce token expiration. There is no public exploit identified at time of analysis, but the small keyspace makes exploitation trivial once a valid link is active; the flaw was reported by VulnCheck and is fixed upstream.