{"id":"CVE-2021-46873","aliases":["EUVD-2021-33526","GHSA-mv36-8276-2729","UBUNTU-CVE-2021-46873"],"status":"published","title":"WireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an...","description":"WireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an adversary might be able to set a victim's system time to a future value, e.g., because unauthenticated NTP is used. This can lead to an outcome in which one static private key becomes permanently useless.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00485,"percentile":0.42271,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-362"],"published":"2023-01-29T00:00:00Z","modified":"2026-10-24T10:30:59Z","affected":[{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wireguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.20200513-1~16.04.1","1.0.20200513-1~16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wireguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.20200513-1~18.04.1","1.0.20200513-1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wireguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.20190913-1ubuntu1","0.0.20191212-1ubuntu1","0.0.20191219-1ubuntu1","1.0.20200102-1ubuntu1","1.0.20200121-1ubuntu1","1.0.20200121-2ubuntu1","1.0.20200206-1ubuntu1","1.0.20200206-2ubuntu1","1.0.20200319-1ubuntu1","1.0.20200513-1~20.04.1","1.0.20200513-1~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wireguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.20210424-1ubuntu1","1.0.20210914-1ubuntu1","1.0.20210914-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wireguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.20210914-1ubuntu3","1.0.20210914-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"wireguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.20210914-1.1ubuntu2","1.0.20210914-3ubuntu1","1.0.20210914-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wireguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.20250521-1ubuntu1","1.0.20260223-1ubuntu1","1.0.20260223-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wireguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.20210914-3ubuntu2","1.0.20250521-1ubuntu1"]}],"products":[{"vendor":"wireguard","product":"wireguard"}],"references":[{"url":"https://lists.zx2c4.com/pipermail/wireguard/2021-August/006916.html","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46873"},{"url":"https://github.com/advisories/GHSA-mv36-8276-2729"},{"url":"https://ubuntu.com/security/CVE-2021-46873","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-46873","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-46873","description":"WireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an adversary might be able to set a victim's system time to a future value, e.g., because unauthenticated NTP is used. This can lead to an outcome in which one static private key becomes permanently useless.","status":"published","published":"2023-01-29T00:00:00Z","modified":"2025-03-28T15:47:37.955Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:33:02.930115Z"}],"euvd":[{"id":"EUVD-2021-33526","description":"WireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an adversary might be able to set a victim's system time to a future value, e.g., because unauthenticated NTP is used. This can lead to an outcome in which one static private key becomes permanently useless.","status":"published","published":"2023-01-29T00:00:00Z","modified":"2025-03-28T15:47:37Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T20:52:48.15902Z"}],"ghsa":[{"id":"GHSA-mv36-8276-2729","title":"WireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an...","description":"WireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an adversary might be able to set a victim's system time to a future value, e.g., because unauthenticated NTP is used. This can lead to an outcome in which one static private key becomes permanently useless.","status":"published","published":"2023-01-30T00:30:34Z","modified":"2025-03-28T18:32:46Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:00:31.530223Z"}],"nvd":[{"id":"CVE-2021-46873","description":"WireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an adversary might be able to set a victim's system time to a future value, e.g., because unauthenticated NTP is used. This can lead to an outcome in which one static private key becomes permanently useless.","status":"published","published":"2023-01-29T23:15:08.703Z","modified":"2026-06-17T04:15:42.2Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:07:07.323379Z"}],"osv":[{"id":"CVE-2021-46873","description":"WireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an adversary might be able to set a victim's system time to a future value, e.g., because unauthenticated NTP is used. This can lead to an outcome in which one static private key becomes permanently useless.","status":"published","published":"2023-01-29T23:15:08.703Z","modified":"2026-10-24T10:30:59.974975142Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:22.18434Z"},{"id":"UBUNTU-CVE-2021-46873","description":"WireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an adversary might be able to set a victim's system time to a future value, e.g., because unauthenticated NTP is used. This can lead to an outcome in which one static private key becomes permanently useless.","status":"published","published":"2023-01-29T23:15:00Z","modified":"2026-10-17T12:56:16.215452625Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:30.277322Z"}]}}