CVE-2024-50596 - Vulnerability Details - OpenCVE

An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects the NetX Duo Web Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\web\nx_web_http_server.c

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://talosintelligence.com/vulnerability_reports/TALOS-2024-2103

History

Wed, 02 Apr 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 02 Apr 2025 13:45:00 +0000

Type	Values Removed	Values Added
Description		An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects the NetX Duo Web Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\web\nx_web_http_server.c
Weaknesses		CWE-191
References		https://talosintelligence.com/vulnerability_reports/TALOS-2024-2103
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}`

MITRE

Status: PUBLISHED

Assigner: talos

Published: 2025-04-02T13:41:55.311Z

Updated: 2025-04-02T15:06:46.402Z

Reserved: 2024-10-25T19:20:52.220Z

Link: CVE-2024-50596

Vulnrichment

Updated: 2025-04-02T15:06:34.800Z

NVD

Status : Awaiting Analysis

Published: 2025-04-02T14:15:44.197

Modified: 2025-04-02T14:58:07.527

Link: CVE-2024-50596

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-50596", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "state": "PUBLISHED", "assignerShortName": "talos", "dateReserved": "2024-10-25T19:20:52.220Z", "datePublished": "2025-04-02T13:41:55.311Z", "dateUpdated": "2025-04-02T15:06:46.402Z"}, "containers": {"cna": {"affected": [{"vendor": "STMicroelectronics", "product": "X-CUBE-AZRT-H7RS", "versions": [{"version": "1.0.0", "status": "affected"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-F4", "versions": [{"version": "1.1.0", "status": "affected"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-F7", "versions": [{"version": "1.1.0", "status": "affected"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-G0", "versions": [{"version": "1.1.0", "status": "affected"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-G4", "versions": [{"version": "2.0.0", "status": "affected"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-H7", "versions": [{"version": "3.3.0", "status": "affected"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-L4", "versions": [{"version": "2.0.0", "status": "affected"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-L5", "versions": [{"version": "2.0.0", "status": "affected"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-WB", "versions": [{"version": "2.0.0", "status": "affected"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-WL", "versions": [{"version": "2.0.0", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects the NetX Duo Web Component HTTP Server implementation which can be found in x-cube-azrtos-f7\\Middlewares\\ST\\netxduo\\addons\\web\\nx_web_http_server.c"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-191: Integer Underflow (Wrap or Wraparound)", "type": "CWE", "cweId": "CWE-191"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2025-04-02T13:41:55.311Z"}, "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2103", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2103"}], "credits": [{"lang": "en", "value": "Discovered by Kelly Patterson of Cisco Talos."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-02T15:06:28.543056Z", "id": "CVE-2024-50596", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-02T15:06:46.402Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-50596", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-02T15:06:28.543056Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-02T15:06:34.800Z"}}], "cna": {"credits": [{"lang": "en", "value": "Discovered by Kelly Patterson of Cisco Talos."}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "STMicroelectronics", "product": "X-CUBE-AZRT-H7RS", "versions": [{"status": "affected", "version": "1.0.0"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-F4", "versions": [{"status": "affected", "version": "1.1.0"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-F7", "versions": [{"status": "affected", "version": "1.1.0"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-G0", "versions": [{"status": "affected", "version": "1.1.0"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-G4", "versions": [{"status": "affected", "version": "2.0.0"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-H7", "versions": [{"status": "affected", "version": "3.3.0"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-L4", "versions": [{"status": "affected", "version": "2.0.0"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-L5", "versions": [{"status": "affected", "version": "2.0.0"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-WB", "versions": [{"status": "affected", "version": "2.0.0"}]}, {"vendor": "STMicroelectronics", "product": "X-CUBE-AZRTOS-WL", "versions": [{"status": "affected", "version": "2.0.0"}]}], "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2103", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2103"}], "descriptions": [{"lang": "en", "value": "An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects the NetX Duo Web Component HTTP Server implementation which can be found in x-cube-azrtos-f7\\Middlewares\\ST\\netxduo\\addons\\web\\nx_web_http_server.c"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-191", "description": "CWE-191: Integer Underflow (Wrap or Wraparound)"}]}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2025-04-02T13:41:55.311Z"}}}, "cveMetadata": {"cveId": "CVE-2024-50596", "state": "PUBLISHED", "dateUpdated": "2025-04-02T15:06:46.402Z", "dateReserved": "2024-10-25T19:20:52.220Z", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "datePublished": "2025-04-02T13:41:55.311Z", "assignerShortName": "talos"}, "dataVersion": "5.1"}