CVE-2024-50595
Estado: ModificadaAlta (7.5)—
An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series of network requests can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability.This vulnerability affects the NetX Duo Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\http\nxd_http_server.c
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.77%
- Percentil entre todas las CVEs puntuadas: 54
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1190Exploit Public-Facing Applicationinitial access60 % - Impacto principal
T1499Endpoint Denial of Serviceimpact55 %
Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (10)
CWE
- CWE-191
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2024-50595",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-50595",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-04-02T14:54:45.845391Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "talos-cna@cisco.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 4.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "LOW",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 1.4,
"exploitabilityScore": 2.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "talos-cna@cisco.com",
"affectedData": [
{
"vendor": "STMicroelectronics",
"product": "X-CUBE-AZRT-H7RS",
"versions": [
{
"status": "affected",
"version": "1.0.0"
}
]
},
{
"vendor": "STMicroelectronics",
"product": "X-CUBE-AZRTOS-F4",
"versions": [
{
"status": "affected",
"version": "1.1.0"
}
]
},
{
"vendor": "STMicroelectronics",
"product": "X-CUBE-AZRTOS-F7",
"versions": [
{
"status": "affected",
"version": "1.1.0"
}
]
},
{
"vendor": "STMicroelectronics",
"product": "X-CUBE-AZRTOS-G0",
"versions": [
{
"status": "affected",
"version": "1.1.0"
}
]
},
{
"vendor": "STMicroelectronics",
"product": "X-CUBE-AZRTOS-G4",
"versions": [
{
"status": "affected",
"version": "2.0.0"
}
]
},
{
"vendor": "STMicroelectronics",
"product": "X-CUBE-AZRTOS-H7",
"versions": [
{
"status": "affected",
"version": "3.3.0"
}
]
},
{
"vendor": "STMicroelectronics",
"product": "X-CUBE-AZRTOS-L4",
"versions": [
{
"status": "affected",
"version": "2.0.0"
}
]
},
{
"vendor": "STMicroelectronics",
"product": "X-CUBE-AZRTOS-L5",
"versions": [
{
"status": "affected",
"version": "2.0.0"
}
]
},
{
"vendor": "STMicroelectronics",
"product": "X-CUBE-AZRTOS-WB",
"versions": [
{
"status": "affected",
"version": "2.0.0"
}
]
},
{
"vendor": "STMicroelectronics",
"product": "X-CUBE-AZRTOS-WL",
"versions": [
{
"status": "affected",
"version": "2.0.0"
}
]
}
]
}
],
"published": "2025-04-02T14:15:43.993",
"references": [
{
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2102",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "talos-cna@cisco.com"
},
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2102",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "talos-cna@cisco.com",
"description": [
{
"lang": "en",
"value": "CWE-191"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series of network requests can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability.This vulnerability affects the NetX Duo Component HTTP Server implementation which can be found in x-cube-azrtos-f7\\Middlewares\\ST\\netxduo\\addons\\http\\nxd_http_server.c"
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de bajo flujo de enteros en el servidor HTTP, poner la funcionalidad de solicitud de STMicroelectronics X-Cube-Azrtos-WL 2.0.0. Una serie especialmente manipulado de solicitudes de red puede conducir a la negación del servicio. Un atacante puede enviar una secuencia de paquetes maliciosos para desencadenar esta vulnerabilidad. Esta vulnerabilidad afecta la implementación del servidor HTTP de componente duo de NetX que se puede encontrar en X-Cube-Azrtos-F7 \\ MiddleWares \\ ST \\ NetXDUO \\ Addons \\ Http \\ NXD_HTTP_Server.c.C"
}
],
"lastModified": "2026-06-17T08:04:46.490",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:st:x-cube-azrt-h7rs:1.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4C5F8DB8-6A3C-492D-8B9D-2211A3FB2C07"
},
{
"criteria": "cpe:2.3:a:st:x-cube-azrtos-f4:1.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A69A0188-96F6-40C7-A2BE-8760297E6249"
},
{
"criteria": "cpe:2.3:a:st:x-cube-azrtos-f7:1.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FF242900-643B-444B-9DE7-0373C810EA22"
},
{
"criteria": "cpe:2.3:a:st:x-cube-azrtos-g0:1.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CEE45297-82B1-4E0B-85DF-4A3C4EEC0391"
},
{
"criteria": "cpe:2.3:a:st:x-cube-azrtos-g4:2.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D14B5944-7E42-45CD-8053-276C8787FC10"
},
{
"criteria": "cpe:2.3:a:st:x-cube-azrtos-h7:3.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F44785CF-9D3D-44AB-8E92-50C9471C6481"
},
{
"criteria": "cpe:2.3:a:st:x-cube-azrtos-l4:2.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B9B78921-0E36-459A-AC17-94AC6AF8847F"
},
{
"criteria": "cpe:2.3:a:st:x-cube-azrtos-l5:2.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "58BA08A3-2A44-43CF-8302-082E44D1B070"
},
{
"criteria": "cpe:2.3:a:st:x-cube-azrtos-wb:2.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "163D6B0F-2A31-401D-A1CD-EC77357767BC"
},
{
"criteria": "cpe:2.3:a:st:x-cube-azrtos-wl:2.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3CD0D34C-C260-4DC4-99A9-24F4C610C710"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "talos-cna@cisco.com"
}