CoAP Server Interface Vulnerability: Amplified DDoS Attacks in IoTivity

CVE-2019-9750 · MEDIUM Severity

AV:N/AC:L/AU:N/C:N/I:P/A:P

In IoTivity through 1.3.1, the CoAP server interface can be used for Distributed Denial of Service attacks using source IP address spoofing and UDP-based traffic amplification. The reflected traffic is 6 times bigger than spoofed requests. This occurs because the construction of a "4.01 Unauthorized" response is mishandled. NOTE: the vendor states "While this is an interesting attack, there is no plan for maintainer to fix, as we are migrating to IoTivity Lite."

Learn more about our Cis Benchmark Audit For Server Software.