PT-2025-14503 · Netx Duo+1 · Netx Duo+1

Kelly Patterson · Publicado 2025-04-02 · Atualizado 2025-09-05 · CVE-2024-50595

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions STMicroelectronics X-CUBE-AZRTOS-WL version 2.0.0

Description An integer underflow issue exists in the HTTP server's PUT request functionality, which can lead to denial of service. This is due to the NetX Duo Component HTTP Server implementation. An attacker can trigger this issue by sending a sequence of malicious packets.

Recommendations For STMicroelectronics X-CUBE-AZRTOS-WL version 2.0.0, consider disabling the HTTP server's PUT request functionality until a patch is available. Restrict access to the nxd http server.c file to minimize the risk of exploitation. Avoid using the vulnerable NetX Duo Component HTTP Server implementation in the x-cube-azrtos-f7MiddlewaresST etxduoaddonshttp directory until the issue is resolved.

Exploit

Correção

DoS

Integer Underflow

Enumeração de Fraquezas

CWE-191

Identificadores relacionados

CVE-2024-50595

Produtos afetados

Netx Duo

Stmicroelectronics X-Cube-Azrtos-Wl

Referências · 9

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2024-2102 · Exploit
• https://twitter.com/CVEnew/status/1907551243603767592 · Publicação no Twitter
• https://t.me/cveNotify/134432 · Publicação no Telegram
• https://t.me/cvetracker/20586 · Publicação no Telegram
• https://twitter.com/syedaquib77/status/1912611333369147673 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1907466810791780399 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2024-50595 · Aviso do Fabricante
• https://t.me/cvedetector/21893 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2024-50595 · Nota de Segurança