CVE-2024-50596
An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects the NetX Duo Web Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\web\nx_web_http_server.c
- Score
- CVSS 3.1 7.5 High
- Status
- Modified - talos-cna@cisco.com
- Published
- 2025-04-02
- Last modified
- 2025-11-03
- Weaknesses
- CWE-191
Affected products
- X-cube-azrt-h7rs (St)
- X-cube-azrtos-f4 (St)
- X-cube-azrtos-f7 (St)
- X-cube-azrtos-g0 (St)
- X-cube-azrtos-g4 (St)
- X-cube-azrtos-h7 (St)
- X-cube-azrtos-l4 (St)
- X-cube-azrtos-l5 (St)
- X-cube-azrtos-wb (St)
- X-cube-azrtos-wl (St)
- X-cube-azrt-h7rs (Stmicroelectronics)
- X-cube-azrtos-f4 (Stmicroelectronics)
- X-cube-azrtos-f7 (Stmicroelectronics)
- X-cube-azrtos-g0 (Stmicroelectronics)
- X-cube-azrtos-g4 (Stmicroelectronics)
- X-cube-azrtos-h7 (Stmicroelectronics)
- X-cube-azrtos-l4 (Stmicroelectronics)
- X-cube-azrtos-l5 (Stmicroelectronics)
- X-cube-azrtos-wb (Stmicroelectronics)
- X-cube-azrtos-wl (Stmicroelectronics)
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2024-2103
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2103
