CVE-2024-23968 Overview
CVE-2024-23968 is a stack-based buffer overflow [CWE-120] affecting ChargePoint Home Flex electric vehicle charging stations. The flaw resides in the SrvrToSmSetAutoChnlListMsg function, which fails to validate the length of user-supplied data before copying it into a fixed-length stack buffer. Network-adjacent attackers can trigger the overflow without authentication and execute arbitrary code with root privileges on the device. The vulnerability affects the NEMA 14-50 plug, NEMA 6-50 plug, and hardwired variants of the Home Flex product line.
Critical Impact
Unauthenticated attackers within radio or LAN range of a vulnerable ChargePoint Home Flex station can achieve remote code execution as root, gaining full control of the charger and any connected network segment.
Affected Products
- ChargePoint Home Flex NEMA 14-50 Plug (firmware and hardware)
- ChargePoint Home Flex NEMA 6-50 Plug (firmware and hardware)
- ChargePoint Home Flex Hardwired (firmware and hardware)
Discovery Timeline
- 2025-01-31 - CVE-2024-23968 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-23968
Vulnerability Analysis
The vulnerability is a classic stack-based buffer overflow [CWE-120] located in the SrvrToSmSetAutoChnlListMsg handler within the ChargePoint Home Flex firmware. This function processes messages related to automatic channel list configuration. When the handler receives attacker-controlled input, it copies the payload into a fixed-size stack buffer without first checking the input length against the destination capacity.
Because the function runs in the context of the root user, successful exploitation grants attackers complete control over the charging station operating system. An attacker can overwrite adjacent stack memory, including saved return addresses, to hijack control flow. From there, they can install persistent malware, pivot into the home network, disrupt vehicle charging, or manipulate energy usage. The Zero Day Initiative tracks this issue under advisory ZDI-24-1050.
Root Cause
The root cause is the absence of bounds checking on user-supplied data prior to a memory copy operation. The SrvrToSmSetAutoChnlListMsg function trusts message length metadata or omits length validation entirely before invoking an unsafe copy into a stack-allocated buffer. This is a canonical example of the improper restriction of operations within the bounds of a memory buffer weakness.
Attack Vector
Exploitation requires adjacent-network access, meaning the attacker must be on the same logical network segment as the target device. This typically includes the local Wi-Fi network, Bluetooth pairing range, or a shared LAN. No authentication or user interaction is required. An attacker crafts a malformed message targeting the vulnerable function, transmits it to the charging station, and triggers the overflow to execute a payload as root. See the Zero Day Initiative Advisory ZDI-24-1050 for additional protocol-level context.
Detection Methods for CVE-2024-23968
Indicators of Compromise
- Unexpected outbound network connections originating from the ChargePoint Home Flex device to unknown IP addresses or non-ChargePoint infrastructure.
- Abnormal charging station reboots, service crashes, or interruptions to normal charging sessions.
- Anomalous traffic patterns on the local network segment shortly after new devices join the Wi-Fi or LAN.
Detection Strategies
- Monitor local network traffic for oversized or malformed messages directed at ChargePoint Home Flex management ports.
- Baseline normal charger-to-cloud communication patterns and alert on deviations such as new destination hosts or protocol anomalies.
- Inspect DHCP and ARP logs for unauthorized devices appearing on the same VLAN as the charging station.
Monitoring Recommendations
- Segment IoT devices, including EV chargers, onto a dedicated VLAN and log all traffic entering or leaving that segment.
- Forward network telemetry from home or fleet-facility routers to a centralized logging platform for retrospective analysis.
- Track firmware version reporting from ChargePoint mobile and web management interfaces to confirm patched builds are deployed.
How to Mitigate CVE-2024-23968
Immediate Actions Required
- Apply the latest firmware update from ChargePoint through the mobile application as soon as it becomes available for your device model.
- Isolate ChargePoint Home Flex units on a segregated network that blocks lateral movement to sensitive endpoints and identity systems.
- Restrict Wi-Fi access to the charger's network segment using strong WPA3 credentials and disable guest network bridging.
Patch Information
ChargePoint distributes firmware updates automatically to Home Flex devices connected to the internet through the ChargePoint cloud service. Owners should confirm the charger is online and verify the current firmware version in the ChargePoint mobile application. Refer to the Zero Day Initiative Advisory ZDI-24-1050 for vendor coordination details. No public exploit is currently known, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Workarounds
- Place the charging station on an isolated Wi-Fi SSID with client isolation enabled to limit adjacent-network exposure.
- Disable remote management features that are not required for daily operation of the charger.
- Restrict physical and wireless access to the charger location to trusted individuals and devices only.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
