CVE-2024-50595 Integer overflow in X-CUBE-AZRT-H7RS
An integer underflow in the HTTP server allows remote attackers to cause a denial of service via crafted network requests.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-50595?
CVE-2024-50595 is a medium-severity vulnerability in STMicroelectronics X-CUBE-AZRT-H7RS, published on 2 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series of network requests can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability.This vulnerability affects the NetX Duo Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\http\nxd_http_server.c
Weakness: CWE-191
Which versions are affected by CVE-2024-50595?
It affects 10 products.
Products include St X-Cube-Azrt-H7rs, St X-Cube-Azrtos-F4, St X-Cube-Azrtos-F7, St X-Cube-Azrtos-G0, St X-Cube-Azrtos-G4, St X-Cube-Azrtos-H7 and 4 more.
How do I fix CVE-2024-50595?
No fix has been published for CVE-2024-50595 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-50595 being exploited?
There is no known exploitation of CVE-2024-50595 in the wild and no public exploit code.
Other vulnerabilities in STMicroelectronics X-CUBE-AZRT-H7RS
Sources
Also known as GHSA-8qc9-45x2-qc2j.