PatchTheCVECVE-2024-50594: An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X
34
Routine
MEDIUM 4.3DOWNGRADEDOWNGRADEDOWNGRADE
CVE-2024-50594 is a medium-severity flaw (CVSS 4.3) affecting x-cube-azrt-h7rs, x-cube-azrtos-f4, x-cube-azrtos-f7. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series of network requests can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability.This vulnerability affects the NetX Duo Web Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\web\nx
Why this priority
- Public exploit reference
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 4.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.8% (top 44%) |
| CISA exploited list | No |
| Weakness | CWE-191 |
| Published | 2025-04-02 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
st x-cube-azrt-h7rs DOWNGRADE
Affected: 1.0.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.0.0
1. Check installed version
apt-cache policy x-cube-azrt-h7rs || rpm -q x-cube-azrt-h7rs || x-cube-azrt-h7rs --version
2. No fixed release: DOWNGRADE to a release before 1.0.0 (Debian / Ubuntu)
apt-cache madison x-cube-azrt-h7rs
sudo apt install x-cube-azrt-h7rs=<VERSION_BEFORE_1.0.0>
sudo apt-mark hold x-cube-azrt-h7rs
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list x-cube-azrt-h7rs
sudo dnf downgrade x-cube-azrt-h7rs-<VERSION_BEFORE_1.0.0>
sudo dnf versionlock add x-cube-azrt-h7rs
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
st x-cube-azrtos-f4 DOWNGRADE
Affected: 1.1.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.1.0
1. Check installed version
apt-cache policy x-cube-azrtos-f4 || rpm -q x-cube-azrtos-f4 || x-cube-azrtos-f4 --version
2. No fixed release: DOWNGRADE to a release before 1.1.0 (Debian / Ubuntu)
apt-cache madison x-cube-azrtos-f4
sudo apt install x-cube-azrtos-f4=<VERSION_BEFORE_1.1.0>
sudo apt-mark hold x-cube-azrtos-f4
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list x-cube-azrtos-f4
sudo dnf downgrade x-cube-azrtos-f4-<VERSION_BEFORE_1.1.0>
sudo dnf versionlock add x-cube-azrtos-f4
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
st x-cube-azrtos-f7 DOWNGRADE
Affected: 1.1.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.1.0
1. Check installed version
apt-cache policy x-cube-azrtos-f7 || rpm -q x-cube-azrtos-f7 || x-cube-azrtos-f7 --version
2. No fixed release: DOWNGRADE to a release before 1.1.0 (Debian / Ubuntu)
apt-cache madison x-cube-azrtos-f7
sudo apt install x-cube-azrtos-f7=<VERSION_BEFORE_1.1.0>
sudo apt-mark hold x-cube-azrtos-f7
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list x-cube-azrtos-f7
sudo dnf downgrade x-cube-azrtos-f7-<VERSION_BEFORE_1.1.0>
sudo dnf versionlock add x-cube-azrtos-f7
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
st x-cube-azrtos-g0 DOWNGRADE
Affected: 1.1.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.1.0
1. Check installed version
apt-cache policy x-cube-azrtos-g0 || rpm -q x-cube-azrtos-g0 || x-cube-azrtos-g0 --version
2. No fixed release: DOWNGRADE to a release before 1.1.0 (Debian / Ubuntu)
apt-cache madison x-cube-azrtos-g0
sudo apt install x-cube-azrtos-g0=<VERSION_BEFORE_1.1.0>
sudo apt-mark hold x-cube-azrtos-g0
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list x-cube-azrtos-g0
sudo dnf downgrade x-cube-azrtos-g0-<VERSION_BEFORE_1.1.0>
sudo dnf versionlock add x-cube-azrtos-g0
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
st x-cube-azrtos-g4 DOWNGRADE
Affected: 2.0.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 2.0.0
1. Check installed version
apt-cache policy x-cube-azrtos-g4 || rpm -q x-cube-azrtos-g4 || x-cube-azrtos-g4 --version
2. No fixed release: DOWNGRADE to a release before 2.0.0 (Debian / Ubuntu)
apt-cache madison x-cube-azrtos-g4
sudo apt install x-cube-azrtos-g4=<VERSION_BEFORE_2.0.0>
sudo apt-mark hold x-cube-azrtos-g4
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list x-cube-azrtos-g4
sudo dnf downgrade x-cube-azrtos-g4-<VERSION_BEFORE_2.0.0>
sudo dnf versionlock add x-cube-azrtos-g4
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
st x-cube-azrtos-h7 DOWNGRADE
Affected: 3.3.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 3.3.0
1. Check installed version
apt-cache policy x-cube-azrtos-h7 || rpm -q x-cube-azrtos-h7 || x-cube-azrtos-h7 --version
2. No fixed release: DOWNGRADE to a release before 3.3.0 (Debian / Ubuntu)
apt-cache madison x-cube-azrtos-h7
sudo apt install x-cube-azrtos-h7=<VERSION_BEFORE_3.3.0>
sudo apt-mark hold x-cube-azrtos-h7
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list x-cube-azrtos-h7
sudo dnf downgrade x-cube-azrtos-h7-<VERSION_BEFORE_3.3.0>
sudo dnf versionlock add x-cube-azrtos-h7
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-50594?
x-cube-azrt-h7rs: downgrade or apply the listed mitigation; x-cube-azrtos-f4: downgrade or apply the listed mitigation; x-cube-azrtos-f7: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2024-50594 being exploited?
CVE-2024-50594 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-50594 affect?
CVE-2024-50594 affects x-cube-azrt-h7rs, x-cube-azrtos-f4, x-cube-azrtos-f7. Severity is medium (CVSS 4.3). An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series of network requests can lead to denial of service. An attacker can send a sequen
How urgent is CVE-2024-50594?
Priority 34/100. Public exploit reference
Related CVEs
- CVE-2024-50597 MEDIUM 4.3 DOWNGRADE DOWNGRADE An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X
- CVE-2024-50596 MEDIUM 4.3 DOWNGRADE DOWNGRADE An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X
- CVE-2024-50595 MEDIUM 4.3 DOWNGRADE DOWNGRADE An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X
- CVE-2024-50385 MEDIUM 6.5 DOWNGRADE DOWNGRADE A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics
- CVE-2024-50384 MEDIUM 6.5 DOWNGRADE DOWNGRADE A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics