https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 25 Oct 2026 21:47:56 +0000 https://db.gcve.eu/vuln/cve-2026-79977 <p><strong>Affected:</strong> zephyrproject zephyr</p> <p>The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handle_transport_data(), when the 32-bit receiver index of an incoming transport-data message matched no session, the code both scheduled a new handshake and copied the datagram&#39;s source address into peer-&gt;endpoint with memcpy(&amp;peer-&gt;endpoint, peer_addr, sizeof(peer-&gt;endpoint)). Because the receiver index is unknown, there is no key with which such a message could be verified, so the address written into peer-&gt;endpoint is entirely attacker-supplied. Every other endpoint update in the implementation happens only after authentication — after the Noise handshake in handle_handshake_init(), or after AEAD decryption plus the anti-replay check in wg_process_data_message().</p> <p>The WireGuard listener is registered with net_udp_register() using no remote address or port filter and defaults to UDP port 51820 (CONFIG_WIREGUARD_PORT), and wg_ctrl_recv() resolves the peer by interface rather than by any cryptographic identity. Any host able to send a UDP datagram to that port can therefore reach the defect off-path, with no need to observe legitimate traffic: a 16-byte datagram carrying the transport-data type, zeroed reserved bytes and an arbitrary receiver index is sufficient. The vulnerable branch runs whenever the peer has neither a valid handshake nor a current keypair — the state at boot and after a session expires.</p> <p>A single spoofed datagram redirects pee…</p> <p><strong>Affected:</strong> zephyrproject zephyr</p> <p>The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handle_transport_data(), when the 32-bit receiver index of an incoming transport-data message matched no session, the code both scheduled a new handshake and copied the datagram&#39;s source address into peer-&gt;endpoint with memcpy(&amp;peer-&gt;endpoint, peer_addr, sizeof(peer-&gt;endpoint)). Because the receiver index is unknown, there is no key with which such a message could be verified, so the address written into peer-&gt;endpoint is entirely attacker-supplied. Every other endpoint update in the implementation happens only after authentication — after the Noise handshake in handle_handshake_init(), or after AEAD decryption plus the anti-replay check in wg_process_data_message().</p> <p>The WireGuard listener is registered with net_udp_register() using no remote address or port filter and defaults to UDP port 51820 (CONFIG_WIREGUARD_PORT), and wg_ctrl_recv() resolves the peer by interface rather than by any cryptographic identity. Any host able to send a UDP datagram to that port can therefore reach the defect off-path, with no need to observe legitimate traffic: a 16-byte datagram carrying the transport-data type, zeroed reserved bytes and an arbitrary receiver index is sufficient. The vulnerable branch runs whenever the peer has neither a valid handshake nor a current keypair — the state at boot and after a session expires.</p> <p>A single spoofed datagram redirects pee…</p> https://db.gcve.eu/vuln/cve-2026-79977