Cesanta Mongoose EUVD-2026-25662

Remote network access to a service using Cesanta Mongoose 7.20 or earlier is required, specifically to applications that rely on GCM-mode encryption (typically in TLS 1.2+ cipher suites like AES-GCM). The attacker must be able to intercept and modify encrypted traffic (on-path attacker position) or have direct access to the encrypted data stream. No authentication is required to attempt the attack. The attack is limited by high cryptographic complexity - the attacker cannot simply flip arbitrary bits; they must either use the publicly available POC or possess cryptographic knowledge to craft valid forged authentication tags. Additionally, not all Mongoose deployments may use GCM encryption; applications using only GCM-incompatible cipher suites or non-TLS encryption are unaffected.

This vulnerability presents moderate real-world risk despite the low CVSS score of 3.7. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms remote, unauthenticated attack surface but with high complexity. The E:P (exploit proof-of-concept) and RL:O (official fix) modifiers indicate public exploit code and vendor patch availability, lowering urgency but not eliminating it. The integrity-only impact (I:L, no C or A) means attackers cannot decrypt data or cause denial of service - they can only inject forged or manipulated messages into encrypted streams. However, in applications using Mongoose's TLS implementation for authentication or integrity verification (JWT tokens, API message signing, secure boot verification), this transforms into business logic compromise. The high attack complexity is a significant limiting factor - this is not a trivial remote exploit suitable for mass scanning. Organizations with Mongoose deployments should prioritize patching only if the library is used for cryptographic authentication in Internet-facing services; internal/air-gapped deployments present lower risk. Publicly available POC increases likelihood of weaponization by sophisticated attackers.

An attacker intercepts encrypted traffic (TLS records or encrypted messages) protected by Mongoose 7.20's GCM implementation. Using the publicly available POC, the attacker crafts a modified ciphertext with a forged authentication tag that passes the flawed verification in mg_aes_gcm_decrypt. The modified plaintext (e.g., a JWT token with elevated privileges, or a command in an encrypted protocol) is accepted by the application as genuine, allowing injection of arbitrary authenticated messages without possession of the encryption key.