What is the CVSS score of CVE-2023-50096?

CVE-2023-50096 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of X Cube Safea1 are affected by CVE-2023-50096?

Organizations using STMicroelectronics STSAFE-A1xx middleware before 3.3.7 face notable risk from CVE-2023-50096, a buffer overflow vulnerability rated CVSS 7.5.

Is there a public PoC exploit available for CVE-2023-50096?

Yes, a public proof-of-concept exploit is available for CVE-2023-50096. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2023-50096?

Within 30 days: Identify all affected systems and apply vendor patches as part of regular patch cycle. If patching is delayed, consider network segmentation to limit exposure.

X Cube Safea1 CVE-2023-50096

HIGH

Classic Buffer Overflow (CWE-120)

2024-01-01 cve@mitre.org

Buffer Overflow RCE X Cube Safea1

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:32 vuln.today

PoC Detected

Nov 21, 2024 - 08:36 vuln.today

Public exploit code

CVE Published

Jan 01, 2024 - 18:15 nvd

HIGH 7.5

DescriptionCVE.org

STMicroelectronics STSAFE-A1xx middleware before 3.3.7 allows MCU code execution if an adversary has the ability to read from and write to the I2C bus. This is caused by an StSafeA_ReceiveBytes buffer overflow in the X-CUBE-SAFEA1 Software Package for STSAFE-A sample applications (1.2.0), and thus can affect user-written code that was derived from a published sample application.

AnalysisAI

STMicroelectronics STSAFE-A1xx middleware before 3.3.7 allows MCU code execution if an adversary has the ability to read from and write to the I2C bus. Rated high severity (CVSS 7.5), this vulnerability is no authentication required. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Buffer Copy without Size Check (CWE-120), which allows attackers to overflow a buffer to corrupt adjacent memory. STMicroelectronics STSAFE-A1xx middleware before 3.3.7 allows MCU code execution if an adversary has the ability to read from and write to the I2C bus. This is caused by an StSafeA_ReceiveBytes buffer overflow in the X-CUBE-SAFEA1 Software Package for STSAFE-A sample applications (1.2.0), and thus can affect user-written code that was derived from a published sample application. Affected products include: St X-Cube-Safea1. Version information: before 3.3.7.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Always validate buffer sizes before copy operations. Use bounded functions (strncpy, snprintf). Enable compiler protections.