CVE-2024-50385

02.04.2025, 14:15

A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects X-CUBE-AZRTOS-F7 NetX Duo Component HTTP Server HTTP server v 1.1.0. This HTTP server implementation is contained in this file - x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\http\nxd_http_server.c

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	6.5 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
talos	CNA	6.5 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 29%

Vendor	Product	Version
st	x-cube-azrt-h7rs	1.0.0
st	x-cube-azrtos-f4	1.1.0
st	x-cube-azrtos-f7	1.1.0
st	x-cube-azrtos-g0	1.1.0
st	x-cube-azrtos-g4	2.0.0
st	x-cube-azrtos-h7	3.3.0
st	x-cube-azrtos-l4	2.0.0
st	x-cube-azrtos-l5	2.0.0
st	x-cube-azrtos-wb	2.0.0
st	x-cube-azrtos-wl	2.0.0

𝑥

= Vulnerable software versions

Known Exploits!

https://talosintelligence.com/vulnerability_reports/TALOS-2024-2097

Common Weakness Enumeration

CWE-459 - Incomplete Cleanup
The software does not properly "clean up" and remove temporary or supporting resources after they have been used.

References

https://talosintelligence.com/vulnerability_reports/TALOS-2024-2097