Description

wolfEngine before 1.4.1 sources the explicit AES-CCM nonce for TLS 1.2 and DTLS 1.2 records from the record input buffer instead of the TLS sequence number carried in the additional authenticated data. Because the record layer leaves the explicit-nonce field for the cipher to populate, the value read is constant across records, so every AES-CCM record within a connection is encrypted under an identical key and nonce pair. Reusing a CCM key and nonce weakens confidentiality (identical keystream across records, so a known record recovers the others) and integrity (authentication tag forgery). Only wolfEngine is affected; wolfProvider is not. AES-GCM under wolfEngine is tracked separately. AES-CCM cipher suites are not enabled by default and must be explicitly selected, which limits exposure. TLS 1.3 and non-TLS use of the cipher are not affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-28T16:18:29.483Z",
  "pubdate": "2026-08-28T16:18:29.483Z",
  "executiveSummary": "wolfEngine versions prior to 1.4.1 contain a critical cryptographic vulnerability in the TLS 1.2 and DTLS 1.2 record layer implementation when using AES-CCM cipher suites.\nThe vulnerability stems from improper nonce sourcing, where the engine reads the explicit nonce from the input buffer rather than deriving it from the TLS sequence number as required by the authenticated encryption with associated data (AEAD) specification.\nThis behavior results in the reuse of identical key and nonce pairs across multiple records within a single connection.\nThe impact includes a catastrophic loss of confidentiality due to identical keystream generation and a significant compromise of message integrity, enabling potential authentication tag forgery.\nWhile the vulnerability is restricted to the wolfEngine component—leaving wolfProvider unaffected—the risk remains high for systems that have explicitly enabled AES-CCM cipher suites, as they are not active by default.\nTLS 1.3 and non-TLS implementations are not impacted by this flaw.\nSuccessful exploitation requires the attacker to be in a position to observe or intercept encrypted traffic for a connection using the vulnerable AES-CCM configuration.",
  "technicalDetails": "The root cause of this vulnerability lies in the incorrect implementation of the AES-CCM nonce construction within the wolfEngine record layer for TLS 1.2 and DTLS 1.2. In standard AEAD operations, the nonce must be unique for every record to ensure the security of the underlying cipher. The protocol specification dictates that the explicit nonce should be derived from the TLS sequence number, which is part of the additional authenticated data (AAD).\nIn the vulnerable wolfEngine implementation, the record layer erroneously reads the explicit-nonce field directly from the raw record input buffer. Because the record layer leaves this specific field for the cipher to populate, the logic erroneously processes a constant, static value rather than the incrementing sequence number. Consequently, every encrypted record transmitted over a connection uses the same key and nonce combination.\nThe technical flow of the exploit begins with the establishment of a TLS/DTLS connection utilizing an AES-CCM cipher suite. As the peer encrypts successive records, the static nonce causes the AES-CCM engine to produce an identical keystream for each packet. In stream cipher-like constructions, including the keystream generation portion of CTR mode used in CCM, the reuse of a nonce allows an attacker to XOR two ciphertexts together, effectively canceling out the keying material and revealing the XOR sum of the two plaintexts. If a single plaintext record is known or can be guessed, the attacker can recover the corresponding plaintext of any other record within the same session.\nFurthermore, the reuse of the nonce severely degrades the integrity protections provided by the CCM authentication tag. Since the CCM tag is calculated based on the nonce and the associated data, the static nonce allows an attacker to perform tag forgery, enabling the injection of arbitrary malicious records into the encrypted stream that the receiver will mistakenly accept as authentic.\nThis vulnerability is localized to wolfEngine versions prior to 1.4.1. Exploitation does not require authentication or elevated privileges, provided the attacker can intercept the network traffic. Because AES-CCM is not enabled by default, the attack surface is limited to environments where developers have explicitly configured these specific cipher suites."
}