CVE-2024-23971
Published: 31 January 2025
Description
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OCPP messages. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.
Security Summary
CVE-2024-23971 is a command injection vulnerability (CWE-77) affecting ChargePoint Home Flex charging stations. The flaw resides in the handling of OCPP messages, where a user-supplied string lacks proper validation before being passed to a system call. This enables network-adjacent attackers to execute arbitrary code in the context of root without requiring authentication.
Network-adjacent attackers can exploit the vulnerability with low complexity, no privileges, and no user interaction, as indicated by the CVSS vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (score 8.8). Successful exploitation allows full arbitrary code execution as root, potentially compromising the device's confidentiality, integrity, and availability.
The Zero Day Initiative advisory at https://www.zerodayinitiative.com/advisories/ZDI-24-1053/ provides further details on the issue, including potential mitigation guidance.
Details
- CWE(s)