St
29 CVEs across 306 St products. Browse St vulnerabilities, severities, and proof-of-concept exploits.
St products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-50597 | Medium | 4.3 | 2025-04-02 | An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted networ… |
CVE-2024-50596 | Medium | 4.3 | 2025-04-02 | An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted networ… |
CVE-2024-50595 | Medium | 4.3 | 2025-04-02 | An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series… |
CVE-2024-50594 | Medium | 4.3 | 2025-04-02 | An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series… |
CVE-2024-50385 | Medium | 6.5 | 2025-04-02 | A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted netw… |
CVE-2024-50384 | Medium | 6.5 | 2025-04-02 | A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted netw… |
CVE-2024-45064 | High | 8.5 | 2025-04-02 | A buffer overflow vulnerability exists in the FileX Internal RAM interface functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted set… |
CVE-2023-36629 | Medium | 5.5 | 2024-01-09 | The ST ST54-android-packages-apps-Nfc package before 130-20230215-23W07p0 for Android has an out-of-bounds read. |
CVE-2023-50096 | High | 7.5 | 2024-01-01 | STMicroelectronics STSAFE-A1xx middleware before 3.3.7 allows MCU code execution if an adversary has the ability to read from and write to the I2C bus. This is… |
CVE-2021-42553 | Medium | 6.8 | 2022-10-21 | A buffer overflow vulnerability in stm32_mw_usb_host of STMicroelectronics in versions before 3.5.1 allows an attacker to execute arbitrary code when the descr… |
CVE-2021-43393 | Medium | 6.2 | 2022-03-04 | STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to abuse signature verification. This is associated with the ECDSA signa… |
CVE-2021-43392 | Medium | 6.2 | 2022-03-04 | STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to obtain information on cryptographic secrets. This is associated with… |
CVE-2021-34268 | Medium | 4.6 | 2021-07-22 | An issue in the USBH_ParseDevDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service (DOS) via a malformed USB d… |
CVE-2021-34267 | Medium | 4.6 | 2021-07-22 | An in the USBH_MSC_InterfaceInit() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service (DOS) when the system tries… |
CVE-2021-34262 | Medium | 6.8 | 2021-07-22 | A buffer overflow vulnerability in the USBH_ParseEPDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attackers to execute arbi… |
CVE-2021-34261 | Medium | 4.6 | 2021-07-22 | An issue in USBH_ParseCfgDesc() of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service due to the system hanging when trying to… |
CVE-2021-34260 | Medium | 6.8 | 2021-07-22 | A buffer overflow vulnerability in the USBH_ParseInterfaceDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attackers to execu… |
CVE-2021-34259 | Medium | 6.8 | 2021-07-22 | A buffer overflow vulnerability in the USBH_ParseCfgDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attackers to execute arb… |
CVE-2021-29414 | Medium | 6.1 | 2021-05-21 | STMicroelectronics STM32L4 devices through 2021-03-29 have incorrect physical access control. |
CVE-2020-27212 | High | 7.0 | 2021-05-21 | STMicroelectronics STM32L4 devices through 2020-10-19 have incorrect access control. The flash read-out protection (RDP) can be degraded from RDP level 2 (no a… |
CVE-2020-20949 | Medium | 5.9 | 2021-01-20 | Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in STM32 cryptographic firmware library software expansion for STM32Cube (UM1924). The vulnerability ca… |
CVE-2020-13466 | Medium | 6.8 | 2020-08-31 | STMicroelectronics STM32F103 devices through 2020-05-20 allow physical attackers to execute arbitrary code via a power glitch and a specific flash patch/breakp… |
CVE-2020-8004 | High | 7.5 | 2020-04-06 | STMicroelectronics STM32F1 devices have Incorrect Access Control. |
CVE-2019-19192 | Medium | 6.5 | 2020-02-12 | The Bluetooth Low Energy implementation on STMicroelectronics BLE Stack through 1.3.1 for STM32WB5x devices does not properly handle consecutive Attribute Prot… |
CVE-2019-16863 | Medium | 5.9 | 2019-11-14 | STMicroelectronics ST33TPHF2ESPI TPM devices before 2019-09-12 allow attackers to extract the ECDSA private key via a side-channel timing attack because ECDSA… |
CVE-2019-14238 | Medium | 6.6 | 2019-09-24 | On STMicroelectronics STM32F7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection method) can be defeated with a debug probe via th… |
CVE-2019-14236 | Critical | 9.8 | 2019-09-12 | On STMicroelectronics STM32L0, STM32L1, STM32L4, STM32F4, STM32F7, and STM32H7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection… |
CVE-2017-18347 | Medium | 4.6 | 2018-09-12 | Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows physically present attackers to extract the device's protected firm… |
CVE-2003-0392 | | 2003-07-02 | Directory traversal vulnerability in ST FTP Service 3.0 allows remote attackers to list arbitrary directories via a CD command with a DoS drive letter argument… |