CVE-2024-50385

Name of the Vulnerable Software and Affected Versions STMicroelectronics X-CUBE-AZRTOS-WL version 2.0.0 STMicroelectronics X-CUBE-AZRTOS-F7 NetX Duo Component HTTP Server version 1.1.0

Description A denial of service issue exists in the NetX Component HTTP server functionality. This can be triggered by a specially crafted network packet, allowing an attacker to send a malicious packet and cause a denial of service. The vulnerable HTTP server implementation is contained in the file nxd http server.c.

Recommendations For STMicroelectronics X-CUBE-AZRTOS-WL version 2.0.0, consider disabling the HTTP server functionality until a patch is available. For STMicroelectronics X-CUBE-AZRTOS-F7 NetX Duo Component HTTP Server version 1.1.0, restrict access to the nxd http server.c file to minimize the risk of exploitation.