St vulnerabilitiesNone on the known-exploited list.
St has 29 published vulnerabilities across 323 products in our catalogue. None of them is on the list of flaws known to be exploited today. The most affected product is X-Cube-Azrtos-F7, with 7. If you run St software, patch the exploited flaws first.
We keep watching the known-exploited list.
Which St products have the most vulnerabilities?
X-Cube-Azrtos-F7 leads with 7 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which St vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of St's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which St flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 3.4%CVE-2019-16863Medium
STMicroelectronics ST33TPHF2ESPI TPM devices before 2019-09-12 allow attackers to extract the ECDSA private key via a side-channel timing attack because ECDSA scalar multiplication is mishandled, aka TPM-FAIL.
- 3.0%CVE-2020-8004High
STMicroelectronics STM32F1 devices have Incorrect Access Control.
- 2.3%CVE-2019-14236Critical
On STMicroelectronics STM32L0, STM32L1, STM32L4, STM32F4, STM32F7, and STM32H7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection method) can be defeated by observing CPU registers and...
- 1.4%CVE-2003-0392Medium
Directory traversal vulnerability in ST FTP Service 3.0 allows remote attackers to list arbitrary directories via a CD command with a DoS drive letter argument (e.g.
- 1.1%CVE-2024-45064High
A buffer overflow vulnerability exists in the FileX Internal RAM interface functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0.
- 1.1%CVE-2021-42553Medium
A buffer overflow vulnerability in stm32_mw_usb_host of STMicroelectronics in versions before 3.5.1 allows an attacker to execute arbitrary code when the descriptor contains more endpoints than USBH_MAX_NUM_ENDPOINTS.
- 1.0%CVE-2019-19192Medium
The Bluetooth Low Energy implementation on STMicroelectronics BLE Stack through 1.3.1 for STM32WB5x devices does not properly handle consecutive Attribute Protocol (ATT) requests on reception, allowing attackers in...
- 0.9%CVE-2020-20949Medium
Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in STM32 cryptographic firmware library software expansion for STM32Cube (UM1924).
- 0.8%CVE-2024-50384Medium
A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0.
- 0.8%CVE-2024-50385Medium
A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0.
All St products we track.
29 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- X-Cube-Azrt-H7rsx-cube-azrt-h7rs7 vulnerabilities2 versions
- X-Cube-Azrtos-F4x-cube-azrtos-f47 vulnerabilities3 versions
- X-Cube-Azrtos-F7x-cube-azrtos-f77 vulnerabilities2 versions
- X-Cube-Azrtos-G0x-cube-azrtos-g07 vulnerabilities2 versions
- X-Cube-Azrtos-G4x-cube-azrtos-g47 vulnerabilities2 versions
- X-Cube-Azrtos-H7x-cube-azrtos-h77 vulnerabilities11 versions
- X-Cube-Azrtos-L4x-cube-azrtos-l47 vulnerabilities3 versions
- X-Cube-Azrtos-L5x-cube-azrtos-l57 vulnerabilities3 versions
- X-Cube-Azrtos-Wbx-cube-azrtos-wb7 vulnerabilities3 versions
- X-Cube-Azrtos-Wlx-cube-azrtos-wl7 vulnerabilities2 versions
- J-Safe3 Firmwarej-safe3_firmware2 vulnerabilities1 version
- Stm32cubel4 Firmwarestm32cubel4_firmware2 vulnerabilities5 versions
- Stsafe-J Firmwarestsafe-j_firmware2 vulnerabilities1 version
- Bluenrg-2bluenrg-21 vulnerability1 version
- FTP Serviceftp_service1 vulnerability1 version
- St33tphf20i2c Firmwarest33tphf20i2c_firmware1 vulnerability2 versions
- St33tphf20spi Firmwarest33tphf20spi_firmware1 vulnerability4 versions
- St33tphf2ei2c Firmwarest33tphf2ei2c_firmware1 vulnerability2 versions
- St33tphf2espi Firmwarest33tphf2espi_firmware1 vulnerability7 versions
- St54-Android-Packages-Apps-Nfcst54-android-packages-apps-nfc1 vulnerability8 versions
- Stm32 Mw USB Hoststm32_mw_usb_host1 vulnerability6 versions
- Stm32f103 Firmwarestm32f103_firmware1 vulnerability1 version
- Wb55wb551 vulnerability1 version
- X-Cube-Safea1x-cube-safea11 vulnerability1 version
This directory lists the 29 St products with at least one tracked version, of 323 in our catalogue.
Running St? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
STMicroelectronics ST33TPHF2ESPI TPM devices before 2019-09-12 allow attackers to extract the ECDSA private key via a side-channel timing attack because ECDSA scalar multiplication is mishandled, aka TPM-FAIL.
- Matched to
- St33tphf2espi on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 29 published vulnerabilities across 323 products and 80 versions from St.
None of St's vulnerabilities is on the list of flaws known to be exploited today.
X-Cube-Azrtos-F7, with 7 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the St products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.