CVE-2024-50596 Integer overflow in X-CUBE-AZRT-H7RS
A remote attacker can cause a denial of service in STMicroelectronics X-CUBE-AZRTOS-WL via a crafted HTTP PUT request triggering an integer underflow.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-50596?
CVE-2024-50596 is a medium-severity vulnerability in STMicroelectronics X-CUBE-AZRT-H7RS, published on 2 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects the NetX Duo Web Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\web\nx_web_http_server.c
Weakness: CWE-191
Which versions are affected by CVE-2024-50596?
It affects 10 products.
Products include St X-Cube-Azrt-H7rs, St X-Cube-Azrtos-F4, St X-Cube-Azrtos-F7, St X-Cube-Azrtos-G0, St X-Cube-Azrtos-G4, St X-Cube-Azrtos-H7 and 4 more.
How do I fix CVE-2024-50596?
No fix has been published for CVE-2024-50596 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-50596 being exploited?
There is no known exploitation of CVE-2024-50596 in the wild and no public exploit code.
Other vulnerabilities in STMicroelectronics X-CUBE-AZRT-H7RS
Sources
Also known as GHSA-8p6x-gw4x-w3jp.