CVE-2019-9750: Iotivity

Critical severity, CVSS 9.1. EPSS: 1.3% chance of exploitation in the next 30 days.

In IoTivity through 1.3.1, the CoAP server interface can be used for Distributed Denial of Service attacks using source IP address spoofing and UDP-based traffic amplification. The reflected traffic is 6 times bigger than spoofed requests. This occurs because the construction of a "4.01 Unauthorized" response is mishandled. NOTE: the vendor states "While this is an interesting attack, there is no plan for maintainer to fix, as we are migrating to IoTivity Lite."

Affected products

• Iotivity Iotivity: up to and including 1.3.1

Published 2019-03-13. Last modified 2026-06-17.