Strix
26.1K

CVE-2019-9750

UnknownEPSS 1.33%

Last modified

CVE-2019-9750 is a vulnerability of currently unknown severity. In IoTivity through 1.3.1, the CoAP server interface can be used for Distributed Denial of Service attacks using source IP address spoofing and UDP-based traffic amplification. The reflected traffic is 6 times bigger than spoofed requests. EPSS estimates a 1.33% chance of exploitation in the next 30 days.

Description

In IoTivity through 1.3.1, the CoAP server interface can be used for Distributed Denial of Service attacks using source IP address spoofing and UDP-based traffic amplification. The reflected traffic is 6 times bigger than spoofed requests. This occurs because the construction of a "4.01 Unauthorized" response is mishandled. NOTE: the vendor states "While this is an interesting attack, there is no plan for maintainer to fix, as we are migrating to IoTivity Lite."

Metrics

EPSS Probability
1.33%

67.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
IotivityIotivity<= 1.3.1

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2019-9750?
In IoTivity through 1.3.1, the CoAP server interface can be used for Distributed Denial of Service attacks using source IP address spoofing and UDP-based traffic amplification. The reflected traffic is 6 times bigger than spoofed requests. This occurs because the construction of a "4.01 Unauthorized" response is mishandled. NOTE: the vendor states "While this is an interesting attack, there is no plan for maintainer to fix, as we are migrating to IoTivity Lite."
How severe is CVE-2019-9750?
Severity scoring for CVE-2019-9750 is pending analysis. The EPSS model estimates a 1.33% probability of exploitation in the next 30 days.
How do I fix CVE-2019-9750?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-9750?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST