CVE-2024-50594
Estado: ModificadaAlta (7.5)—
An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series of network requests can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability.This vulnerability affects the NetX Duo Web Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\web\nx_web_http_server.c
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.77%
- Percentil entre todas las CVEs puntuadas: 54
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1190Exploit Public-Facing Applicationinitial access85 % - Impacto principal
T1499.004Application or System Exploitationimpact80 %
Vector CVSS con AV:N/PR:N/UI:N apunta a T1190 (explotación de aplicación expuesta). CWE-191 (integer underflow) en servidor HTTP remoto causa negación de servicio (T1499.004: application exhaustion).
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (10)
CWE
- CWE-191
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2024-50594",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-50594",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-04-02T14:58:32.955206Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "talos-cna@cisco.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 4.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "LOW",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 1.4,
"exploitabilityScore": 2.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "talos-cna@cisco.com",
"affectedData": [
{
"vendor": "STMicroelectronics",
"product": "X-CUBE-AZRT-H7RS",
"versions": [
{
"status": "affected",
"version": "1.0.0"
}
]
},
{
"vendor": "STMicroelectronics",
"product": "X-CUBE-AZRTOS-F4",
"versions": [
{
"status": "affected",
"version": "1.1.0"
}
]
},
{
"vendor": "STMicroelectronics",
"product": "X-CUBE-AZRTOS-F7",
"versions": [
{
"status": "affected",
"version": "1.1.0"
}
]
},
{
"vendor": "STMicroelectronics",
"product": "X-CUBE-AZRTOS-G0",
"versions": [
{
"status": "affected",
"version": "1.1.0"
}
]
},
{
"vendor": "STMicroelectronics",
"product": "X-CUBE-AZRTOS-G4",
"versions": [
{
"status": "affected",
"version": "2.0.0"
}
]
},
{
"vendor": "STMicroelectronics",
"product": "X-CUBE-AZRTOS-H7",
"versions": [
{
"status": "affected",
"version": "3.3.0"
}
]
},
{
"vendor": "STMicroelectronics",
"product": "X-CUBE-AZRTOS-L4",
"versions": [
{
"status": "affected",
"version": "2.0.0"
}
]
},
{
"vendor": "STMicroelectronics",
"product": "X-CUBE-AZRTOS-L5",
"versions": [
{
"status": "affected",
"version": "2.0.0"
}
]
},
{
"vendor": "STMicroelectronics",
"product": "X-CUBE-AZRTOS-WB",
"versions": [
{
"status": "affected",
"version": "2.0.0"
}
]
},
{
"vendor": "STMicroelectronics",
"product": "X-CUBE-AZRTOS-WL",
"versions": [
{
"status": "affected",
"version": "2.0.0"
}
]
}
]
}
],
"published": "2025-04-02T14:15:43.773",
"references": [
{
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2102",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "talos-cna@cisco.com"
},
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2102",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "talos-cna@cisco.com",
"description": [
{
"lang": "en",
"value": "CWE-191"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series of network requests can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability.This vulnerability affects the NetX Duo Web Component HTTP Server implementation which can be found in x-cube-azrtos-f7\\Middlewares\\ST\\netxduo\\addons\\web\\nx_web_http_server.c"
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de bajo flujo de enteros en el servidor HTTP, poner la funcionalidad de solicitud de STMicroelectronics X-Cube-Azrtos-WL 2.0.0. Una serie especialmente manipulado de solicitudes de red puede conducir a la negación del servicio. Un atacante puede enviar una secuencia de paquetes maliciosos para desencadenar esta vulnerabilidad. Esta vulnerabilidad afecta la implementación del servidor HTTP de componente web NetX Duo que se puede encontrar en X-Cube-Azrtos-F7 \\ MiddleWares \\ ST \\ NetXDUO \\ Addons \\ Web \\ nx_web_http_server.c.C"
}
],
"lastModified": "2026-06-17T08:04:46.377",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:st:x-cube-azrt-h7rs:1.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4C5F8DB8-6A3C-492D-8B9D-2211A3FB2C07"
},
{
"criteria": "cpe:2.3:a:st:x-cube-azrtos-f4:1.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A69A0188-96F6-40C7-A2BE-8760297E6249"
},
{
"criteria": "cpe:2.3:a:st:x-cube-azrtos-f7:1.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FF242900-643B-444B-9DE7-0373C810EA22"
},
{
"criteria": "cpe:2.3:a:st:x-cube-azrtos-g0:1.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CEE45297-82B1-4E0B-85DF-4A3C4EEC0391"
},
{
"criteria": "cpe:2.3:a:st:x-cube-azrtos-g4:2.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D14B5944-7E42-45CD-8053-276C8787FC10"
},
{
"criteria": "cpe:2.3:a:st:x-cube-azrtos-h7:3.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F44785CF-9D3D-44AB-8E92-50C9471C6481"
},
{
"criteria": "cpe:2.3:a:st:x-cube-azrtos-l4:2.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B9B78921-0E36-459A-AC17-94AC6AF8847F"
},
{
"criteria": "cpe:2.3:a:st:x-cube-azrtos-l5:2.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "58BA08A3-2A44-43CF-8302-082E44D1B070"
},
{
"criteria": "cpe:2.3:a:st:x-cube-azrtos-wb:2.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "163D6B0F-2A31-401D-A1CD-EC77357767BC"
},
{
"criteria": "cpe:2.3:a:st:x-cube-azrtos-wl:2.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3CD0D34C-C260-4DC4-99A9-24F4C610C710"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "talos-cna@cisco.com"
}