CVE-2026-13734: Zephyr WireGuard VPN Privilege Escalation

CVE-2026-13734 Overview

CVE-2026-13734 is an authentication weakness (CWE-294) in the Zephyr Real-Time Operating System (RTOS) WireGuard Virtual Private Network (VPN) implementation. The data-plane receive handler wg_process_data_message() in subsys/net/lib/wireguard/wg_crypto.c validated the Authenticated Encryption with Associated Data (AEAD) anti-replay counter after committing peer-state mutations. A network attacker who captures a valid transport packet can replay it from a spoofed source address to hijack the peer endpoint, redirect outbound tunnel traffic, and prematurely destroy the previous keypair.

Critical Impact
Replayed-but-authentic WireGuard packets can redirect victim tunnel traffic to an attacker-controlled address and disrupt session state without requiring credentials.

Affected Products

Zephyr RTOS WireGuard VPN subsystem (subsys/net/lib/wireguard/wg_crypto.c)
Zephyr builds enabling the WireGuard data-plane dispatch in subsys/net/lib/wireguard/wg.c
Downstream firmware and IoT devices integrating the affected Zephyr WireGuard module

Discovery Timeline

2026-08-28 - CVE-2026-13734 published to the National Vulnerability Database (NVD)
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-13734

Vulnerability Analysis

The defect lies in the ordering of security checks inside wg_process_data_message(). After successful AEAD decryption of a MESSAGE_TRANSPORT_DATA packet, the handler invoked update_peer_addr() for endpoint roaming, refreshed keypair->last_rx and peer->last_rx liveness timers, and called keypair_update() to promote the next keypair and destroy the previous one. Only after these mutations did the code call wg_check_replay().

On a replayed packet the check returned -EINVAL, but the previously committed state changes were never rolled back. The AEAD tag authenticates content but not freshness, so a replayed transport packet decrypts successfully and passes cryptographic validation.

Root Cause

The root cause is an ordering error between cryptographic authentication and freshness validation. The WireGuard specification and the Linux reference implementation require the anti-replay counter check to occur immediately after successful decryption and before any peer-state mutation. The Zephyr implementation deferred that check, allowing authentic-but-stale packets to influence peer state.

Attack Vector

The handler is driven directly from inbound User Datagram Protocol (UDP) datagrams and requires no credentials. An on-path or shared-medium observer captures a valid ciphertext, then re-injects the packet from an arbitrary spoofed source address. The replay repoints the peer endpoint to the attacker-chosen address, redirecting subsequent outbound tunnel traffic until the legitimate peer transmits again. The payload remains encrypted under the session keypair, so the impact is integrity and availability, not confidentiality.

 		goto out;
 	}
 
+	/* The packet authenticated correctly. Validate the anti-replay counter
+	 * before committing any peer state. A replayed-but-authentic packet
+	 * (e.g. captured and re-injected from a spoofed source address) must
+	 * not be able to mutate the endpoint, liveness timers or keypair state.
+	 */
+	if (!wg_check_replay(keypair, nonce)) {
+		ret = -EINVAL;
+		vpn_stats_update_replay_error(ctx);
+		goto out;
+	}
+
 	if (!peer->first_valid) {
 		net_mgmt_event_notify(NET_EVENT_VPN_CONNECTED, peer->iface);
 		peer->first_valid = true;

Source: Zephyr commit 260c32ef

Detection Methods for CVE-2026-13734

Indicators of Compromise

Unexpected changes to a WireGuard peer endpoint address that do not correspond to legitimate roaming events on the remote peer.
Elevated vpn_stats_update_replay_error counters or -EINVAL returns from wg_process_data_message() in device telemetry.
Premature destruction of a previous keypair followed by immediate reversion when the legitimate peer transmits.

Detection Strategies

Compare peer endpoint address history across the tunnel's two endpoints to detect asymmetric roaming updates.
Correlate duplicate ciphertexts observed on shared network segments with subsequent peer-state changes on the Zephyr device.
Monitor for repeated identical UDP payloads targeting the WireGuard listen port from differing source addresses.

Monitoring Recommendations

Export Zephyr VPN statistics, including replay-error counters, to a centralized logging pipeline for baseline deviation analysis.
Alert on WireGuard endpoint changes that occur without a corresponding handshake message exchange.
Track tunnel outbound traffic destinations for sudden shifts to previously unseen peer addresses.

How to Mitigate CVE-2026-13734

Immediate Actions Required

Apply the upstream Zephyr patch that relocates wg_check_replay() to execute immediately after successful decryption and before peer-state mutation.
Rebuild and redeploy firmware images for all Zephyr-based devices using the WireGuard subsystem.
Rotate WireGuard session state by triggering a fresh handshake on affected peers after patching.

Patch Information

The fix is committed in the Zephyr project at commit 260c32ef and documented in GitHub Security Advisory GHSA-x7q7-fjx9-4vj2. The patch moves the anti-replay validation ahead of update_peer_addr(), liveness timer updates, and keypair_update(), aligning the implementation with the WireGuard specification and the Linux reference.

Workarounds

Restrict WireGuard UDP ingress to known peer source addresses using upstream firewall or network access control lists where feasible.
Deploy Zephyr devices on network segments that limit exposure to on-path or shared-medium observers capable of capturing tunnel ciphertext.
Shorten WireGuard rekey intervals to reduce the window in which a captured packet remains valid for replay.

bash

# Example: restrict inbound WireGuard UDP to a known peer address (Linux upstream gateway)
iptables -A FORWARD -p udp --dport 51820 -s <legitimate_peer_ip> -j ACCEPT
iptables -A FORWARD -p udp --dport 51820 -j DROP