PT-2025-14504 · Unknown+1 · Netx Duo Web Component Http Server+1

Kelly Patterson · Published 2025-04-02 · Updated 2025-09-05 · CVE-2024-50596

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions STMicroelectronics X-CUBE-AZRTOS-WL version 2.0.0

Description An integer underflow vulnerability exists in the HTTP server PUT request functionality. A specially crafted network packet can lead to denial of service. This issue affects the NetX Duo Web Component HTTP Server implementation, specifically in the nx web http server.c file. An attacker can send a malicious packet to trigger this vulnerability.

Recommendations For STMicroelectronics X-CUBE-AZRTOS-WL version 2.0.0, consider disabling the HTTP server PUT request functionality until a patch is available to prevent potential denial of service attacks. Restrict access to the NetX Duo Web Component HTTP Server implementation to minimize the risk of exploitation.

Exploit

Fix

DoS

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2024-50596

Affected Products

Netx Duo Web Component Http Server

X-Cube-Azrtos-Wl

References · 8

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2024-2103 · Exploit
• https://osv.dev/vulnerability/CVE-2024-50596 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-50596 · Security Note
• https://twitter.com/CVEnew/status/1907551246552318438 · Twitter Post
• https://t.me/cvedetector/21887 · Telegram Post
• https://t.me/cveNotify/134456 · Telegram Post
• https://twitter.com/syedaquib77/status/1912611271406649606 · Twitter Post
• https://t.me/cvetracker/20587 · Telegram Post