CVE-2026-6986

Katalog CVE

CVSS 3.7 · Low EPSS 0,25%

Kerentanan Insufficient Verification of Data Authenticity pada cesanta mongoose. Skor CVSS 3.1 3.7 (Low) menurut vuldb.com.

Deskripsi (NVD)

A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This issue affects the function mg_aes_gcm_decrypt of the file /src/tls_aes128.c of the component GCM Authentication Tag Handler. Such manipulation leads to improper verification of cryptographic signature. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 7.21 is capable of addressing this issue. It is advisable to upgrade the affected component. VulDB has contacted the vendor early and they confirmed quickly, that this issue got fixed already.

Rincian

Terbit di NVD

25 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.7 (Low), sumber vuldb.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity
CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/dwBruijn/CVEs/blob/main/Mongoose/AESGCM.md exploit · advisory pihak ketiga
• https://vuldb.com/submit/796231 advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/359529 advisory pihak ketiga · vdb entry
• https://github.com/cesanta/mongoose/releases/tag/7.21 release notes
• https://vuldb.com/vuln/359529/cti permissions required · vdb entry