Riskcovery

CVE-2024-50594

State
Published
Severity
4.3 Medium
Published
Apr 2, 2025
Updated
Nov 3, 2025
Reserved
Oct 25, 2024

Read the record on cve.org

Description

An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series of network requests can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability.This vulnerability affects the NetX Duo Web Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\web\nx_web_http_server.c

Scores

CVSSScoreVectorSource
3.14.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Ltalos

Weaknesses

  • CWE-191 Integer Underflow (Wrap or Wraparound)

Affected Products

ProductVersions
X-CUBE-AZRT-H7RSSTMicroelectronics
  • 1.0.0Affected
X-CUBE-AZRTOS-F4STMicroelectronics
  • 1.1.0Affected
X-CUBE-AZRTOS-F7STMicroelectronics
  • 1.1.0Affected
X-CUBE-AZRTOS-G0STMicroelectronics
  • 1.1.0Affected
X-CUBE-AZRTOS-G4STMicroelectronics
  • 2.0.0Affected
X-CUBE-AZRTOS-H7STMicroelectronics
  • 3.3.0Affected
X-CUBE-AZRTOS-L4STMicroelectronics
  • 2.0.0Affected
X-CUBE-AZRTOS-L5STMicroelectronics
  • 2.0.0Affected
X-CUBE-AZRTOS-WBSTMicroelectronics
  • 2.0.0Affected
X-CUBE-AZRTOS-WLSTMicroelectronics
  • 2.0.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.