The vulnerability resides in the getpeer function of src/net_builtin.c within Cesanta Mongoose, affecting TCP sequence number handling. It allows an attacker to manipulate network traffic such that the source of a communication channel is not properly verified, potentially permitting spoofed connections or hijacked sessions. This flaw can be triggered remotely, has a high attack complexity rating, and is reported as difficult to exploit, yet the vulnerability has been publicly disclosed and could be used in real‑world attacks.

Cesanta Mongoose versions up to and including 7.20 are affected. All deployments that use these versions without an update to a later release may be vulnerable. No specific patch information is available from the vendor, and the vendor has not responded to the disclosure.

The CVSS base score of 6.3 indicates moderate severity, and the EPSS rating of <1% suggests a low probability of exploitation in recent data. The vulnerability is not listed in the CISA KEV catalog, but its public disclosure and remote nature mean that it could be leveraged by attackers who succeed in traversing network boundaries. The high attack complexity and reported difficulty reduce the likelihood of immediate widespread exploitation, but the lack of vendor response and absence of a published fix warrant proactive monitoring and preparation for a future remediation.