Vulnerability Description
An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series of network requests can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability.This vulnerability affects the NetX Duo Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\http\nxd_http_server.c
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| St | X-Cube-Azrt-H7Rs | 1.0.0 |
| St | X-Cube-Azrtos-F4 | 1.1.0 |
| St | X-Cube-Azrtos-F7 | 1.1.0 |
| St | X-Cube-Azrtos-G0 | 1.1.0 |
| St | X-Cube-Azrtos-G4 | 2.0.0 |
| St | X-Cube-Azrtos-H7 | 3.3.0 |
| St | X-Cube-Azrtos-L4 | 2.0.0 |
| St | X-Cube-Azrtos-L5 | 2.0.0 |
| St | X-Cube-Azrtos-Wb | 2.0.0 |
| St | X-Cube-Azrtos-Wl | 2.0.0 |
Related Weaknesses (CWE)
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2024-2102ExploitThird Party Advisory
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2102
FAQ
What is CVE-2024-50595?
CVE-2024-50595 is a vulnerability with a CVSS score of 4.3 (MEDIUM). An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series of network requests can lead to denial o...
How severe is CVE-2024-50595?
CVE-2024-50595 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-50595?
Check the references section above for vendor advisories and patch information. Affected products include: St X-Cube-Azrt-H7Rs, St X-Cube-Azrtos-F4, St X-Cube-Azrtos-F7, St X-Cube-Azrtos-G0, St X-Cube-Azrtos-G4.