CVE-2024-23921
High
Description
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the wlanapp module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.
SeverityHigh
CVSS8.8
Exploit probability—
ProductChargepoint Home Flex Nema 14-50 Plug Firmware
PublishedJan 31, 2025
First seenJan 31, 2025
Weakness typeCWE-94Code injection
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| chargepoint home_flex_nema_14-50_plug_firmware | No range specified | — |
| chargepoint home_flex_hardwired_firmware | No range specified | — |
| chargepoint home_flex_nema_6-50_plug_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.