CVE-2024-23968
Published: 31 January 2025
Description
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SrvrToSmSetAutoChnlListMsg function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
Security Summary
CVE-2024-23968 is a buffer overflow vulnerability (CWE-120) in ChargePoint Home Flex charging stations. The flaw resides in the SrvrToSmSetAutoChnlListMsg function, where user-supplied data length is not properly validated before being copied into a fixed-length stack-based buffer. This issue enables network-adjacent attackers to execute arbitrary code without authentication, earning a CVSS v3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Network-adjacent attackers can exploit this vulnerability by sending crafted packets to the affected charging station. No privileges or user interaction are required, allowing remote code execution in the context of root. This grants full control over the device, with high impacts on confidentiality, integrity, and availability.
The Zero Day Initiative advisory (ZDI-24-1050) provides further details at https://www.zerodayinitiative.com/advisories/ZDI-24-1050/.
Details
- CWE(s)