CVE-2024-23970 Details
Description
This vulnerability allows network-adjacent attackers to compromise transport security on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CURLOPT_SSL_VERIFYHOST setting. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root.
A vulnerability exists in ChargePoint Home Flex charging stations, allowing network-adjacent attackers to compromise transport security. The issue arises from improper validation of the server's certificate, specifically related to the CURLOPT_SSL_VERIFYHOST setting. This flaw can be exploited without authentication and may be leveraged alongside other vulnerabilities to execute code with root privileges.
The vendor has stated that the vulnerability has been addressed, but verification is pending. As a mitigation strategy, it is recommended to restrict interaction with the application.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 31, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-24-1052/ | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| chargepoint home flex nema 14-50 plug firmware | All versions |
CPE
Remediation
| |
| chargepoint home flex nema 14-50 plug | All versions |
CPE
Remediation
| |
| chargepoint home flex hardwired firmware | All versions |
CPE
Remediation
| |
| chargepoint home flex hardwired | All versions |
CPE
Remediation
| |
| chargepoint home flex nema 6-50 plug firmware | All versions |
CPE
Remediation
| |
| chargepoint home flex nema 6-50 plug | All versions |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Sep 30, 2025 | Modified Analysis | [email protected] |
| Aug 26, 2025 | CVE Modified | CISA-ADP |
| Jun 30, 2025 | CVE Modified | [email protected] |
| May 1, 2025 | Initial Analysis | [email protected] |
| Jan 31, 2025 | CVE Modified | CISA-ADP |
| Jan 31, 2025 | New CVE Received | [email protected] |