CVE-2024-23920: ChargePoint Home Flex RCE Vulnerability

CVE-2024-23920 Overview

CVE-2024-23920 is an improper access control vulnerability [CWE-284] in ChargePoint Home Flex charging stations. The flaw resides in the onboardee module and allows network-adjacent attackers to execute arbitrary code as root without authentication. Zero Day Initiative disclosed the issue in advisory ZDI-24-1048, and the CVE was published to the National Vulnerability Database on January 31, 2025.

Critical Impact
Unauthenticated adjacent-network attackers can obtain root-level code execution on affected ChargePoint Home Flex units, giving full control over the charging station firmware.

Affected Products

ChargePoint Home Flex NEMA 14-50 Plug (hardware and firmware)
ChargePoint Home Flex Hardwired (hardware and firmware)
ChargePoint Home Flex NEMA 6-50 Plug (hardware and firmware)

Discovery Timeline

2025-01-31 - CVE-2024-23920 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23920

Vulnerability Analysis

The vulnerability affects the onboardee module of the ChargePoint Home Flex firmware. This module handles device provisioning and initial setup workflows exposed on the local network interface. Improper access control checks allow an unauthenticated attacker on the adjacent network to reach privileged onboarding functionality that should be restricted to first-time setup or authorized administrators.

Because the onboardee module runs with elevated privileges, successful exploitation results in arbitrary code execution in the context of root. An attacker who compromises the charger can pivot into the home network, tamper with charging behavior, exfiltrate account credentials tied to the ChargePoint cloud, or persist malicious firmware on the device.

The issue is classified under CWE-284: Improper Access Control. No public exploit has been published, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The onboardee module fails to enforce authentication or authorization on privileged handlers. Setup-phase endpoints remain reachable after provisioning, and the module accepts requests from any host on the same Wi-Fi or Ethernet segment as the charger. The absence of state validation between the onboarding lifecycle and normal operation exposes root-level functionality to unauthenticated callers.

Attack Vector

Exploitation requires network adjacency, meaning the attacker must reside on the same local network segment as the charging station, such as a shared Wi-Fi network or a compromised device inside the home LAN. Once adjacent, the attacker sends crafted requests to the onboardee service to trigger privileged operations. No user interaction and no credentials are required. Technical exploitation details are described in Zero Day Initiative Advisory ZDI-24-1048.

Detection Methods for CVE-2024-23920

Indicators of Compromise

Unexpected TCP or UDP traffic to the ChargePoint Home Flex management ports from unknown LAN hosts.
Charging station firmware version, configuration, or Wi-Fi credentials changing without administrator action.
New outbound connections from the charger to non-ChargePoint infrastructure.
Unexplained charger reboots, factory-reset states, or repeated re-entry into onboarding mode.

Detection Strategies

Baseline the expected network flows for the charger and alert on deviations, including traffic to onboarding endpoints outside a provisioning window.
Monitor DHCP and ARP tables for rogue devices appearing on the same VLAN as the charger.
Inspect router logs for repeated connection attempts to the charger's IP from unrecognized local hosts.

Monitoring Recommendations

Place the charger on an isolated IoT VLAN and log all north-south and east-west traffic touching that segment.
Enable wireless intrusion detection to identify unauthorized clients joining the network segment hosting the charger.
Correlate charger telemetry from the ChargePoint mobile app with local network events to spot unauthorized configuration changes.

How to Mitigate CVE-2024-23920

Immediate Actions Required

Isolate ChargePoint Home Flex units on a dedicated VLAN or guest network with no route to sensitive internal systems.
Restrict Wi-Fi access to the charger's network segment using strong WPA2/WPA3 credentials and MAC filtering where feasible.
Confirm the charger is running the latest firmware available via the ChargePoint mobile application.
Contact ChargePoint support to verify remediation status and request firmware updates for affected models.

Patch Information

No vendor advisory URL was published alongside the NVD entry at the time of writing. Refer to Zero Day Initiative Advisory ZDI-24-1048 for coordinated disclosure details and check the ChargePoint support portal for firmware updates addressing the onboardee module.

Workarounds

Segment the charger away from workstations, servers, and IoT devices holding sensitive data.
Disable Wi-Fi on the charger where a wired connection is available, reducing exposure to nearby wireless attackers.
Block inbound connections to the charger from any host other than the administrator's provisioning device using local firewall rules.
Power down or unplug chargers that must remain on shared or untrusted networks until a firmware fix is verified.

bash

# Example: isolate the charger on a dedicated VLAN (Linux/OpenWrt router)
# Replace eth0.30 and the charger MAC with values for your environment
uci set network.iot=interface
uci set network.iot.proto='static'
uci set network.iot.ifname='eth0.30'
uci set network.iot.ipaddr='192.168.30.1'
uci set network.iot.netmask='255.255.255.0'
uci commit network

# Block traffic from the IoT VLAN to the trusted LAN
iptables -I FORWARD -i eth0.30 -o br-lan -j DROP