CVE-2024-50385 - Vulnerability Details - OpenCVE

A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects X-CUBE-AZRTOS-F7 NetX Duo Component HTTP Server HTTP server v 1.1.0. This HTTP server implementation is contained in this file - x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\http\nxd_http_server.c

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://talosintelligence.com/vulnerability_reports/TALOS-2024-2097

History

Wed, 02 Apr 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 02 Apr 2025 13:45:00 +0000

Type	Values Removed	Values Added
Description		A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects X-CUBE-AZRTOS-F7 NetX Duo Component HTTP Server HTTP server v 1.1.0. This HTTP server implementation is contained in this file - x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\http\nxd_http_server.c
Weaknesses		CWE-459
References		https://talosintelligence.com/vulnerability_reports/TALOS-2024-2097
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: talos

Published: 2025-04-02T13:41:57.295Z

Updated: 2025-04-02T14:47:26.202Z

Reserved: 2024-10-23T18:58:47.945Z

Link: CVE-2024-50385

Vulnrichment

Updated: 2025-04-02T14:47:19.707Z

NVD

Status : Awaiting Analysis

Published: 2025-04-02T14:15:43.583

Modified: 2025-04-02T14:58:07.527

Link: CVE-2024-50385

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-50385", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "state": "PUBLISHED", "assignerShortName": "talos", "dateReserved": "2024-10-23T18:58:47.945Z", "datePublished": "2025-04-02T13:41:57.295Z", "dateUpdated": "2025-04-02T14:47:26.202Z"}, "containers": {"cna": {"affected": [{"vendor": "STMicroelectronics", "product": "X-CUBE-AZRT-H7RS", "versions": [{"version": "1.0.0", "status": "affected"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-F4", "versions": [{"version": "1.1.0", "status": "affected"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-F7", "versions": [{"version": "1.1.0", "status": "affected"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-G0", "versions": [{"version": "1.1.0", "status": "affected"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-G4", "versions": [{"version": "2.0.0", "status": "affected"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-H7", "versions": [{"version": "3.3.0", "status": "affected"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-L4", "versions": [{"version": "2.0.0", "status": "affected"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-L5", "versions": [{"version": "2.0.0", "status": "affected"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-WB", "versions": [{"version": "2.0.0", "status": "affected"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-WL", "versions": [{"version": "2.0.0", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects X-CUBE-AZRTOS-F7 NetX Duo Component HTTP Server HTTP server v 1.1.0. This HTTP server implementation is contained in this file - x-cube-azrtos-f7\\Middlewares\\ST\\netxduo\\addons\\http\\nxd_http_server.c"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-459: Incomplete Cleanup", "type": "CWE", "cweId": "CWE-459"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2025-04-02T13:41:57.295Z"}, "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2097", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2097"}], "credits": [{"lang": "en", "value": "Discovered by Kelly Patterson of Cisco Talos."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-02T14:44:04.971401Z", "id": "CVE-2024-50385", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-02T14:47:26.202Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-50385", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-02T14:44:04.971401Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-02T14:47:19.707Z"}}], "cna": {"credits": [{"lang": "en", "value": "Discovered by Kelly Patterson of Cisco Talos."}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "STMicroelectronics", "product": "X-CUBE-AZRT-H7RS", "versions": [{"status": "affected", "version": "1.0.0"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-F4", "versions": [{"status": "affected", "version": "1.1.0"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-F7", "versions": [{"status": "affected", "version": "1.1.0"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-G0", "versions": [{"status": "affected", "version": "1.1.0"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-G4", "versions": [{"status": "affected", "version": "2.0.0"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-H7", "versions": [{"status": "affected", "version": "3.3.0"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-L4", "versions": [{"status": "affected", "version": "2.0.0"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-L5", "versions": [{"status": "affected", "version": "2.0.0"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-WB", "versions": [{"status": "affected", "version": "2.0.0"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-WL", "versions": [{"status": "affected", "version": "2.0.0"}]}], "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2097", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2097"}], "descriptions": [{"lang": "en", "value": "A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects X-CUBE-AZRTOS-F7 NetX Duo Component HTTP Server HTTP server v 1.1.0. This HTTP server implementation is contained in this file - x-cube-azrtos-f7\\Middlewares\\ST\\netxduo\\addons\\http\\nxd_http_server.c"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-459", "description": "CWE-459: Incomplete Cleanup"}]}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2025-04-02T13:41:57.295Z"}}}, "cveMetadata": {"cveId": "CVE-2024-50385", "state": "PUBLISHED", "dateUpdated": "2025-04-02T14:47:26.202Z", "dateReserved": "2024-10-23T18:58:47.945Z", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "datePublished": "2025-04-02T13:41:57.295Z", "assignerShortName": "talos"}, "dataVersion": "5.1"}