A weakness was identified in Cesanta Mongoose versions up to 7.20 in the mg_sendnsreq function used for DNS transaction ID handling. Manipulation of the random argument can produce insufficiently random values. The vulnerability can be exploited remotely, although the required complexity and difficulty of the exploitation are high. Public evidence of the exploit has been released. As a result, an attacker could potentially predict DNS transaction IDs and cause forged DNS responses to be accepted by the resolver.

Cesanta Mongoose up to and including version 7.20.

The CVSS score of 6.3 indicates moderate severity. The EPSS score of less than 1% suggests low likelihood of widespread exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote and would require an attacker to predict DNS transaction IDs by manipulating the random value, a task that is complex and difficult. Publicly available exploit code demonstrates the feasibility of such an attack, but real‑world exploitation would still need to overcome the high complexity barrier.