PT-2025-14502 · Stmicroelectronics+1 · Stmicroelectronics X-Cube-Azrtos-Wl+1

Kelly Patterson · Published 2025-04-02 · Updated 2025-09-05 · CVE-2024-50594

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions STMicroelectronics X-CUBE-AZRTOS-WL version 2.0.0

Description An integer underflow issue exists in the HTTP server's PUT request functionality, which can lead to denial of service. This issue affects the NetX Duo Web Component HTTP Server implementation. An attacker can trigger this issue by sending a sequence of malicious packets.

Recommendations For STMicroelectronics X-CUBE-AZRTOS-WL version 2.0.0, consider disabling the HTTP server's PUT request functionality until a patch is available. Restrict access to the NetX Duo Web Component HTTP Server implementation to minimize the risk of exploitation. Avoid using the vulnerable nx web http server.c component in the x-cube-azrtos-f7MiddlewaresST etxduoaddonsweb directory until the issue is resolved.

Exploit

Fix

DoS

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2024-50594

Affected Products

Netx Duo Web Component Http Server

Stmicroelectronics X-Cube-Azrtos-Wl

References · 8

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2024-2102 · Exploit
• https://osv.dev/vulnerability/CVE-2024-50594 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-50594 · Security Note
• https://twitter.com/syedaquib77/status/1912611239475192282 · Twitter Post
• https://twitter.com/CVEnew/status/1907551244585201692 · Twitter Post
• https://t.me/cvetracker/20585 · Telegram Post
• https://t.me/cveNotify/134431 · Telegram Post
• https://t.me/cvedetector/21892 · Telegram Post