Severity by source
Network-observable TLS attack with high complexity due to seed brute-force requirement; no integrity or availability impact, only confidentiality of TLS session content.
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Lifecycle Timeline
1DescriptionCVE.org
[mg_random rand() fallback used for TLS secrets]
AnalysisAI
Cryptographically weak TLS secret generation in Cesanta's Mongoose embedded networking library exposes TLS sessions to potential decryption by network observers. The mg_random() function falls back to the standard C library rand() - a non-cryptographic PRNG with predictable output - when a proper entropy source is unavailable, generating TLS keying material that can be predicted or brute-forced. No public exploit has been identified at time of analysis, and no KEV listing exists, but the structural weakness is deterministic on platforms lacking a secure entropy source.
Technical ContextAI
Mongoose (cesanta/mongoose) is a widely used embedded C networking library providing HTTP, MQTT, WebSocket, and TLS support for IoT, firmware, and embedded Linux targets. TLS secret generation relies on mg_random(), which is intended to wrap a platform CSPRNG (e.g., /dev/urandom on Linux, hardware RNG on microcontrollers). The fallback path invokes POSIX rand(), a linear congruential generator seeded typically from time(NULL) or a fixed seed - both are predictable and produce a short, non-uniform keyspace. CWE classification is not confirmed in the source data but the root cause matches CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator) or CWE-330 (Use of Insufficiently Random Values). Affected platforms are those where Mongoose cannot obtain OS or hardware entropy at runtime, causing silent fallback rather than a hard failure. The Ubuntu vendor report suggests this manifests on Linux-class systems as well as bare-metal targets.
Affected ProductsAI
The affected product is the Mongoose embedded networking library (cesanta/mongoose) in versions that implement the mg_random() rand() fallback. The exact affected version range is not confirmed in the available source data - only the Ubuntu vendor report is listed, with no CPE strings, vendor advisory URL, or NVD entry provided. Affected deployments are those where Mongoose is compiled and run on platforms without a reliable CSPRNG (e.g., bare-metal microcontrollers, minimal RTOS environments, or constrained Linux configurations). Ubuntu's report implies at least some packaged or vendored Mongoose versions in the Ubuntu ecosystem are affected.
RemediationAI
The primary remediation is to upgrade to a patched version of Mongoose in which mg_random() either uses a guaranteed CSPRNG and fails hard rather than falling back to rand(), or requires the platform to provide entropy before any TLS operation proceeds. No exact patch version is confirmed in the available data - check the upstream Cesanta Mongoose GitHub releases and the Ubuntu Security Notices (USN) for the specific fixed package version. As a compensating control for deployments that cannot immediately patch: audit all Mongoose-based firmware and applications to confirm they provide a functional entropy source (e.g., ensure /dev/urandom is available, or that the platform-specific mg_random() override is correctly implemented). Disable TLS entirely on deployments running the vulnerable fallback path until a patch is applied - plaintext communication over an isolated network may be preferable to false-security TLS with predictable keys. Note: simply seeding rand() with a better seed does not constitute a fix, as rand() output remains statistically weak and short-cycle regardless of seed quality.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today