Apache IoTDB releases prior to 1.3.7 and 2.0.7 contain insecure default configuration that may allow an attacker to connect to the database service without proper authentication or to modify configuration values. The associated CWE‑1327 indicates that input or service parameters are not adequately validated, which can lead to unauthorized configuration changes. The CVSS score of 9.8 reflects the potential for severe disruption, including loss of confidentiality, integrity, or availability, if the insecure defaults are abused.

All Apache IoTDB 1.x releases before 1.3.7 and all 2.x releases before 2.0.7 are affected. Organizations should verify the installed component version and determine whether it falls within the vulnerable range.

The EPSS score of less than 1 % indicates that the vulnerability is not frequently exploited in the wild and it is not currently listed in CISA’s KEV catalog. Nevertheless, the high severity and the nature of the flaw mean that an attacker who can reach the IoTDB service over the network could potentially bypass authentication or alter configuration settings, using the default credentials or unprotected ports. No documented workaround exists, so the only effective mitigation is to apply the vendor’s patch or to eliminate the insecure defaults as a temporary measure.