This vulnerability in Cesanta Mongoose (up to version 7.20) involves the mg_tls_verify_cert_signature function in the mongoose.c file, specifically within the P-384 Public Key Handler. A manipulation of this function can lead to an authorization bypass, potentially allowing unauthorized access. Exploitation is remote but considered highly complex and difficult. The vendor responded promptly and released a fixed version 7.21, which includes a patch identified by commit 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1.

Successful exploitation of this vulnerability could allow an attacker to bypass authorization controls remotely, potentially gaining unauthorized access to protected resources. However, the complexity of the attack and the difficulty of exploitation reduce the likelihood of widespread exploitation. There are no known exploits in the wild at this time.

Upgrade affected Cesanta Mongoose versions (7.0 through 7.20) to version 7.21, which contains an official fix for this vulnerability. The vendor has released this patch promptly, and applying this update will remediate the issue. No additional mitigation steps are indicated by the vendor advisory.