Vulnerability Details CVE-2019-9750
In IoTivity through 1.3.1, the CoAP server interface can be used for Distributed Denial of Service attacks using source IP address spoofing and UDP-based traffic amplification. The reflected traffic is 6 times bigger than spoofed requests. This occurs because the construction of a "4.01 Unauthorized" response is mishandled. NOTE: the vendor states "While this is an interesting attack, there is no plan for maintainer to fix, as we are migrating to IoTivity Lite."
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 51.0%
CVSS Severity
CVSS v3 Score 9.1
CVSS v2 Score 6.4
Products affected by CVE-2019-9750
-
cpe:2.3:a:iotivity:iotivity:0.9.0
-
cpe:2.3:a:iotivity:iotivity:0.9.1
-
cpe:2.3:a:iotivity:iotivity:0.9.2
-
cpe:2.3:a:iotivity:iotivity:1.0.0
-
cpe:2.3:a:iotivity:iotivity:1.0.1
-
cpe:2.3:a:iotivity:iotivity:1.1.0
-
cpe:2.3:a:iotivity:iotivity:1.1.1
-
cpe:2.3:a:iotivity:iotivity:1.2.0
-
cpe:2.3:a:iotivity:iotivity:1.2.1
-
cpe:2.3:a:iotivity:iotivity:1.3.0
-
cpe:2.3:a:iotivity:iotivity:1.3.1