CVE-2024-23969: ChargePoint Home Flex Firmware RCE Flaw

CVE-2024-23969 Overview

CVE-2024-23969 is an out-of-bounds write vulnerability [CWE-787] in ChargePoint Home Flex electric vehicle charging stations. The flaw resides in the wlanchnllst function, which fails to properly validate user-supplied data before writing it to a fixed-length buffer. Network-adjacent attackers can exploit this weakness without authentication to execute arbitrary code with root privileges on the device. The vulnerability affects the Home Flex hardwired unit and both NEMA 6-50 and NEMA 14-50 plug variants. The Zero Day Initiative published advisory ZDI-24-1051 tracking this issue.

Critical Impact
Unauthenticated network-adjacent attackers can achieve root code execution on residential EV charging stations, gaining persistent control over the charging hardware and its network connectivity.

Affected Products

ChargePoint Home Flex Hardwired (firmware)
ChargePoint Home Flex NEMA 6-50 Plug (firmware)
ChargePoint Home Flex NEMA 14-50 Plug (firmware)

Discovery Timeline

2025-01-31 - CVE-2024-23969 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23969

Vulnerability Analysis

The vulnerability is triggered when the wlanchnllst function processes attacker-controlled input related to WLAN channel list handling. The function accepts data from the network without enforcing a length or boundary check before copying it into a fixed-size buffer. This condition permits a write beyond the allocated memory region, corrupting adjacent memory structures. An attacker on the same network segment as the charging station can send a crafted request that overwrites saved return addresses or function pointers. Successful exploitation yields code execution in the context of root, the highest privilege level on the embedded Linux firmware. Because the attack vector is Adjacent Network (AV:A), an attacker must reside on the same Wi-Fi or logical broadcast domain as the charger.

Root Cause

The root cause is missing bounds validation in the wlanchnllst routine [CWE-787]. The function assumes network-sourced input conforms to expected size constraints and copies data into a stack or heap buffer without measuring the input length against the destination capacity. This class of defect is common in embedded firmware where performance and code size take precedence over defensive input handling.

Attack Vector

Exploitation requires network adjacency to the charging station, typically Wi-Fi association with the same access point or presence on the local LAN. No authentication is required. The attacker sends a malformed message targeting the vulnerable channel-list parsing path, overflowing the buffer and hijacking execution flow. Once code executes as root, the attacker can pivot to the home network, tamper with charging behavior, or maintain persistence across reboots by modifying firmware components.

No public proof-of-concept code is available. Refer to the ZDI advisory ZDI-24-1051 for additional technical context.

Detection Methods for CVE-2024-23969

Indicators of Compromise

Unexpected outbound connections from the ChargePoint Home Flex device to unknown external hosts on non-standard ports.
Anomalous Wi-Fi probe or management frame activity directed at the charging station from previously unseen client MAC addresses.
Unexplained device reboots, firmware version discrepancies, or configuration changes reported by the ChargePoint mobile app.

Detection Strategies

Monitor local network traffic to and from the charger for malformed packets targeting WLAN configuration endpoints or oversized channel-list payloads.
Baseline the device's normal communication profile (cloud endpoints, DNS lookups, protocol usage) and alert on deviations.
Inspect wireless intrusion detection system (WIDS) logs for rogue association attempts and abnormal management frame patterns near the charger.

Monitoring Recommendations

Isolate the charger on a dedicated VLAN or IoT SSID and enable NetFlow or packet capture at the segment boundary for forensic review.
Track firmware version reported by the device and alert when it drifts from the vendor-approved baseline.
Correlate wireless client join events with charger telemetry to identify unauthorized adjacency to the device.

How to Mitigate CVE-2024-23969

Immediate Actions Required

Verify the charging station is running the latest firmware distributed by ChargePoint through the mobile application or cloud auto-update mechanism.
Place the Home Flex charger on a segregated network segment isolated from workstations, servers, and sensitive IoT devices.
Restrict Wi-Fi access to the charger's network segment using WPA2/WPA3 with a strong pre-shared key and disable guest access on that SSID.

Patch Information

No vendor advisory URL is published in the NVD record for CVE-2024-23969. Owners should confirm patch availability through ChargePoint support and the ChargePoint mobile application, which manages firmware updates for Home Flex hardware. Consult the Zero Day Initiative advisory ZDI-24-1051 for coordinated disclosure status.

Workarounds

Disable the charger's Wi-Fi interface where feasible and rely on cellular or wired uplink options if supported by the deployment.
Enable client isolation on the wireless access point serving the charger to block lateral communication from other Wi-Fi clients.
Restrict physical proximity attack surface by ensuring the charger is not reachable from adversary-controlled wireless networks in adjacent properties.

bash

# Example: isolate the charger on a dedicated VLAN using OpenWrt-style configuration
uci set network.iot=interface
uci set network.iot.proto='static'
uci set network.iot.ipaddr='192.168.50.1'
uci set network.iot.netmask='255.255.255.0'
uci set firewall.iot_zone=zone
uci set firewall.iot_zone.name='iot'
uci set firewall.iot_zone.forward='REJECT'
uci commit && /etc/init.d/network restart