CVE-2024-23921: ChargePoint Home Flex Firmware RCE Flaw

CVE-2024-23921 Overview

CVE-2024-23921 is a command injection vulnerability in ChargePoint Home Flex electric vehicle charging stations. The flaw resides in the wlanapp module, which fails to properly validate user-supplied strings before passing them to a system call. Network-adjacent attackers can exploit this weakness without authentication to execute arbitrary code as root on the device. The issue is tracked under CWE-94: Improper Control of Generation of Code and was disclosed through the Zero Day Initiative Advisory ZDI-24-1049.

Critical Impact
Unauthenticated attackers on the adjacent network can achieve root-level remote code execution on ChargePoint Home Flex charging stations, gaining full control of the device and its charging operations.

Affected Products

ChargePoint Home Flex NEMA 14-50 Plug (firmware and hardware)
ChargePoint Home Flex Hardwired (firmware and hardware)
ChargePoint Home Flex NEMA 6-50 Plug (firmware and hardware)

Discovery Timeline

2025-01-31 - CVE-2024-23921 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23921

Vulnerability Analysis

CVE-2024-23921 is a command injection flaw in the wlanapp module of the ChargePoint Home Flex firmware. The module accepts user-supplied string input and passes that input into a system call without adequate validation or sanitization. Because the affected code path runs with root privileges, successful exploitation yields full administrative control over the charging station.

Exploitation requires only adjacent network access, which typically maps to Wi-Fi range or a shared local network segment. No credentials or user interaction are required, and the vulnerability affects the confidentiality, integrity, and availability of the device.

An attacker with root code execution on the charger can pivot to internal home or business networks, tamper with charging logic, brick the unit, or use it as a persistent implant on the local network. The device manages high-voltage charging hardware, making integrity and availability impacts particularly relevant.

Root Cause

The root cause is missing input validation in the wlanapp component. User-controlled data is concatenated into a command string and passed to a shell interpreter or a function such as system() without escaping shell metacharacters. This pattern maps directly to CWE-94: Improper Control of Generation of Code.

Attack Vector

The attack vector is adjacent-network. An attacker positioned on the same wireless or local network segment as the charging station sends a crafted request containing shell metacharacters embedded in a parameter processed by wlanapp. The injected payload is executed by the underlying shell in the context of the root account, giving the attacker arbitrary command execution on the device.

No verified public proof-of-concept is available. Additional technical detail is documented in the Zero Day Initiative Advisory ZDI-24-1049.

Detection Methods for CVE-2024-23921

Indicators of Compromise

Unexpected outbound network connections originating from the ChargePoint Home Flex to unknown IP addresses or non-ChargePoint infrastructure.
Unusual DNS queries or beaconing patterns from the charger's IP address on the local network.
Anomalous traffic to the charger's Wi-Fi management interface, particularly requests containing shell metacharacters such as ;, &, |, or backticks.
Unexplained reboots, firmware behavior changes, or configuration drift on the charging station.

Detection Strategies

Monitor local network segments hosting IoT and charging equipment for lateral movement, port scans, and reconnaissance targeting the charger's management ports.
Inspect Wi-Fi provisioning and configuration traffic to the Home Flex for payloads containing shell metacharacters or command separators.
Baseline normal traffic patterns from the charger and alert on deviations in destination, volume, or protocol.

Monitoring Recommendations

Segment charging stations onto a dedicated VLAN and log all inbound and outbound flows at the segmentation boundary.
Forward network telemetry from IoT segments into a centralized data lake or SIEM for retention and correlation.
Track firmware version and configuration state of each charger to detect unauthorized changes.

How to Mitigate CVE-2024-23921

Immediate Actions Required

Isolate ChargePoint Home Flex units on a dedicated network segment or VLAN, restricting adjacent-network exposure to trusted devices only.
Disable or restrict access to the charger's Wi-Fi management interface where operationally feasible.
Inventory all deployed Home Flex units and confirm they are running the latest available firmware from ChargePoint.
Review network logs for signs of adjacent-network reconnaissance or exploitation attempts targeting the charger.

Patch Information

No vendor advisory URL is listed in the NVD record at the time of publication. Administrators should consult ChargePoint directly and reference the Zero Day Initiative Advisory ZDI-24-1049 for coordinated disclosure details. Home Flex chargers typically receive firmware updates automatically through the ChargePoint cloud service; verify that each unit is online and has received the most recent firmware.

Workarounds

Place the charger behind a firewall or on an isolated SSID with client isolation enabled to block adjacent-network attack paths.
Restrict Wi-Fi access to the charger's network to known, trusted devices using MAC filtering or WPA3-Enterprise where supported.
Disable remote configuration features that are not strictly required for operation.

bash

# Example: isolate the charger on a dedicated VLAN and block lateral traffic
# (adapt interface names and subnets to your environment)
vconfig add eth0 40
ip addr add 192.0.2.1/24 dev eth0.40
iptables -A FORWARD -i eth0.40 -o eth0.40 -j DROP
iptables -A FORWARD -i eth0.40 -d 192.168.0.0/16 -j DROP