CVE-2024-23971

HIGH

ChargePoint Home Flex Firmware - Unauthenticated Remote Code Execution via OCPP Message Handling

Title source: llm

Description

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OCPP messages. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.

References (1)

Core 1

Core References

Third Party Advisory

https://www.zerodayinitiative.com/advisories/ZDI-24-1053/

Scores

CVSS v3 8.8

EPSS 0.0047

EPSS Percentile 37.3%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-77

Status published

Products (3)

chargepoint/home_flex_hardwired_firmware

chargepoint/home_flex_nema_14-50_plug_firmware

chargepoint/home_flex_nema_6-50_plug_firmware

Published Jan 31, 2025

Tracked Since Feb 18, 2026