CVE-2024-23969 Details
Description
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the wlanchnllst function. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root.
A vulnerability in ChargePoint Home Flex charging stations allows network-adjacent attackers to execute arbitrary code. This issue arises from the wlanchnllst function, where user-supplied data is not properly validated, leading to a buffer overflow. Exploitation of this vulnerability allows code execution with root privileges, and no authentication is required.
According to the vendor, this vulnerability was patched in April 2024.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 31, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-24-1051/ | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| chargepoint home flex nema 14-50 plug firmware | All versions |
CPE
Remediation
| |
| chargepoint home flex nema 14-50 plug | All versions |
CPE
Remediation
| |
| chargepoint home flex hardwired firmware | All versions |
CPE
Remediation
| |
| chargepoint home flex hardwired | All versions |
CPE
Remediation
| |
| chargepoint home flex nema 6-50 plug firmware | All versions |
CPE
Remediation
| |
| chargepoint home flex nema 6-50 plug | All versions |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Sep 30, 2025 | Modified Analysis | [email protected] |
| Aug 26, 2025 | CVE Modified | CISA-ADP |
| Jun 30, 2025 | CVE Modified | [email protected] |
| May 1, 2025 | Initial Analysis | [email protected] |
| Jan 31, 2025 | CVE Modified | CISA-ADP |
| Jan 31, 2025 | New CVE Received | [email protected] |