CVE-2024-23971: ChargePoint Home Flex RCE Vulnerability

CVE-2024-23971 Overview

CVE-2024-23971 is a command injection vulnerability affecting ChargePoint Home Flex electric vehicle charging stations. The flaw resides in the handling of Open Charge Point Protocol (OCPP) messages. The station fails to properly validate a user-supplied string before passing it to a system call. Network-adjacent attackers can exploit the issue without authentication to execute arbitrary code as root on the device. The weakness is classified as [CWE-77] Improper Neutralization of Special Elements used in a Command.

Critical Impact
Unauthenticated attackers on the adjacent network can achieve root-level code execution on ChargePoint Home Flex charging stations by sending crafted OCPP messages.

Affected Products

ChargePoint Home Flex NEMA 14-50 Plug (firmware and hardware)
ChargePoint Home Flex Hardwired (firmware and hardware)
ChargePoint Home Flex NEMA 6-50 Plug (firmware and hardware)

Discovery Timeline

2025-01-31 - CVE-2024-23971 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23971

Vulnerability Analysis

CVE-2024-23971 is a command injection vulnerability in the OCPP message handler on ChargePoint Home Flex charging stations. OCPP is the standard application-layer protocol used between charging stations and central management systems. The device parses fields from OCPP messages and incorporates them into a shell command executed by the operating system. Because the input is not sanitized or escaped, an attacker can inject shell metacharacters that break out of the intended command context.

Successful exploitation yields arbitrary command execution in the context of the root account. This grants full control over the charging station, including firmware, network configuration, credentials, and charging behavior. The vulnerability requires no authentication and no user interaction, and the attack vector is limited to the adjacent network.

Root Cause

The root cause is the lack of input validation on a user-supplied string within an OCPP message before it is concatenated into a system call. This maps to [CWE-77], where untrusted input flows directly into a command interpreter without neutralization of delimiters such as ;, |, &, or backticks.

Attack Vector

An attacker on the same network segment as the charging station sends a crafted OCPP message containing shell metacharacters in an attacker-controlled field. The station's OCPP handler passes the malicious string to a system call. The injected commands execute with root privileges. Further technical detail is available in the Zero Day Initiative Advisory ZDI-24-1053.

Detection Methods for CVE-2024-23971

Indicators of Compromise

Unexpected outbound network connections initiated from the charging station to unfamiliar hosts
Unauthorized firmware modifications, new binaries, or persistence artifacts on the device
OCPP messages containing shell metacharacters such as ;, |, &&, or backticks in string fields
Anomalous charging session behavior or configuration changes not initiated by the owner or operator

Detection Strategies

Inspect OCPP traffic between charging stations and central systems for malformed or metacharacter-laden field values
Baseline normal network behavior of Home Flex devices and alert on deviations in destination, port, or volume
Monitor the Wi-Fi or LAN segment where the charger resides for unauthorized device enumeration or protocol probing

Monitoring Recommendations

Enable network flow logging on the segment hosting the charging station and forward records to a central analytics platform
Deploy network detection sensors capable of parsing OCPP WebSocket traffic for anomalous payloads
Review vendor cloud portal logs for unexpected configuration changes, firmware rollbacks, or session activity

How to Mitigate CVE-2024-23971

Immediate Actions Required

Isolate ChargePoint Home Flex devices on a dedicated VLAN or Wi-Fi SSID separate from workstations and servers
Restrict inbound access to the charging station to only the required central management system endpoints
Verify that affected units are running the latest firmware distributed by ChargePoint through the mobile application or cloud service
Audit the network segment for unauthorized devices that could reach the charger over the adjacent network

Patch Information

No vendor advisory URL is listed in the NVD entry. Consult the Zero Day Initiative Advisory ZDI-24-1053 and contact ChargePoint support to confirm the fixed firmware version and deployment mechanism for Home Flex units.

Workarounds

Place the charger behind a firewall that blocks OCPP traffic from untrusted sources
Disable or restrict Wi-Fi access on the charger where feasible and use wired connectivity with strict segmentation
Monitor and alert on any new device joining the charger's network segment until firmware remediation is confirmed

bash

# Example: isolate charger to a dedicated VLAN and block lateral traffic
# Replace VLAN IDs and interfaces with values from your environment
vlan 42
  name EV_CHARGERS
interface GigabitEthernet0/10
  switchport mode access
  switchport access vlan 42

# Permit only outbound OCPP (WSS/443) to the management endpoint, deny lateral traffic
ip access-list extended EV_CHARGER_ACL
  permit tcp 10.42.0.0 0.0.0.255 host <ocpp-central-system-ip> eq 443
  deny   ip 10.42.0.0 0.0.0.255 10.0.0.0 0.255.255.255
  permit ip 10.42.0.0 0.0.0.255 any