Despite the popularity of IoT software systems and the vast array of smart devices, security challenges persist, particularly due to the scarcity of documented practices that support the mitigation of security risks. This lack of guidance increases uncertainty regarding the vulnerabilities that affect such systems. In light of this scenario, this dissertation presents the findings of two literature studies (one ad-hoc and one structured) that support decision-making regarding mitigating security risks in IoT software systems. The results of these studies were organized and consolidated into a Vulnerability Catalog for IoT Software Systems. This catalog brings together information to support identifying and potential mitigation strategies for the mapped vulnerabilities. In total, 73 vulnerabilities were identified and classified into four main categories: Application, Network, Device, and a fourth category, Peopleware, which, unlike traditional studies, highlights the human factor as a critical element in the security of these systems.
.png)
.png)
