Integer Underflow Vulnerability in STMicroelectronics X-CUBE-AZRTOS-WL

CVE-2024-50594

What is CVE-2024-50594?

An integer underflow vulnerability has been identified in the HTTP server's PUT request mechanism of STMicroelectronics' X-CUBE-AZRTOS-WL version 2.0.0. This flaw allows attackers to craft a series of malicious network requests that can lead to a denial of service, impacting the functionality of the NetX Duo Web Component's HTTP Server. Specifically, this vulnerability resides in the source code located at x-cube-azrtos-f7/Middlewares/ST/netxduo/addons/web/nx_web_http_server.c. Attackers exploiting this vulnerability can disrupt service availability, highlighting the importance of securing server components against such attacks.

References