PT-2021-7641 · Wireguard · Wireguard

Karolin Varner · Published 2021-08-08 · Updated 2026-04-10 · CVE-2021-46873

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WireGuard versions 0.5.3

Description The issue is related to the implementation of the NTP protocol in WireGuard on Windows, which does not fully account for the possibility that an adversary might set a victim's system time to a future value, for example, because unauthenticated NTP is used. This can lead to a situation where one static private key becomes permanently useless. The vulnerability is related to insufficient input validation, which can be exploited by a remote attacker to cause a denial of service.

Recommendations For WireGuard version 0.5.3, consider disabling the use of unauthenticated NTP to minimize the risk of exploitation until a patch is available. Restrict access to the NTP protocol to prevent an attacker from setting the system time to a future value.

Fix

RCE

Race Condition

Weakness Enumeration

CWE-20

CWE-362

Related Identifiers

BDU:2023-00658

CVE-2021-46873

Affected Products

Wireguard

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2021-46873 · Security Note
• https://bdu.fstec.ru/vul/2023-00658 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-46873 · Security Note
• https://osv.dev/vulnerability/CVE-2021-46873 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-46873 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-46873 · Vendor Advisory
• https://t.me/cibsecurity/57137 · Telegram Post
• https://reddit.com/r/cybersecurity/comments/1imtdcs/how_bad_is_these_cve_should_i_not_allow_such · Reddit Post
• https://lists.zx2c4.com/pipermail/wireguard/2021-August/006916.html · Note
• https://twitter.com/msdevelx/status/2042624817279451214 · Twitter Post
• https://t.me/cvenotify/43793 · Telegram Post
• https://t.me/cvenotify/43042 · Telegram Post