CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2024-23971

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OCPP messages. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.001

EPSS Ranking 29.0%

CVSS Severity

CVSS v3 Score 8.8

References

https://www.zerodayinitiative.com/advisories/ZDI-24-1053/

Products affected by CVE-2024-23971

Chargepoint » Home Flex Hardwired » Version: N/A

cpe:2.3:h:chargepoint:home_flex_hardwired:-
Chargepoint » Home Flex Nema 14-50 Plug » Version: N/A

cpe:2.3:h:chargepoint:home_flex_nema_14-50_plug:-
Chargepoint » Home Flex Nema 6-50 Plug » Version: N/A

cpe:2.3:h:chargepoint:home_flex_nema_6-50_plug:-
Chargepoint » Home Flex Hardwired Firmware » Version: N/A

cpe:2.3:o:chargepoint:home_flex_hardwired_firmware:-
Chargepoint » Home Flex Nema 14-50 Plug Firmware » Version: N/A

cpe:2.3:o:chargepoint:home_flex_nema_14-50_plug_firmware:-
Chargepoint » Home Flex Nema 6-50 Plug Firmware » Version: N/A

cpe:2.3:o:chargepoint:home_flex_nema_6-50_plug_firmware:-

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2024-23971

Products

Pricing

Contact Us