CVE-2024-23971
📋 TL;DR
CVE-2024-23971 is a command injection vulnerability in ChargePoint Home Flex charging stations that allows network-adjacent attackers to execute arbitrary code as root without authentication. The flaw exists in OCPP message handling where user-supplied strings aren't properly validated before system calls. All ChargePoint Home Flex charging stations with vulnerable firmware are affected.
💻 Affected Systems
- ChargePoint Home Flex charging station
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of charging station with root access, allowing attackers to disable charging, manipulate billing, access connected networks, or use the device as a foothold for further attacks.
Likely Case
Attackers on the same network could disrupt charging operations, steal user data, or use the device for cryptocurrency mining or botnet participation.
If Mitigated
With network segmentation and proper firewalls, impact is limited to charging station functionality disruption without lateral movement.
🎯 Exploit Status
Exploitation requires network adjacency and knowledge of OCPP protocol, but no authentication is needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check ChargePoint firmware updates
Vendor Advisory: https://www.chargepoint.com/security
Restart Required: Yes
Instructions:
1. Log into ChargePoint account 2. Navigate to device management 3. Check for firmware updates 4. Apply available updates 5. Reboot charging station
🔧 Temporary Workarounds
Network Segmentation
allIsolate charging stations on separate VLAN with strict firewall rules
Disable Unnecessary Services
allDisable OCPP or restrict to trusted management systems only
🧯 If You Can't Patch
- Segment charging stations on isolated network with no internet access
- Implement strict firewall rules blocking all inbound traffic except from management systems
🔍 How to Verify
Check if Vulnerable:
Check firmware version in ChargePoint app or web interface and compare against latest patched versionCheck Version:
Check via ChargePoint mobile app: Settings > About > Firmware VersionVerify Fix Applied:
Verify firmware version has been updated to latest version and test OCPP functionality📡 Detection & Monitoring
Log Indicators:
- Unusual OCPP message patterns
- System command execution logs
- Failed authentication attempts on adjacent systems
Network Indicators:
- Unusual OCPP traffic from unexpected sources
- Outbound connections from charging station to suspicious IPs
SIEM Query:
source="chargepoint" AND (ocpp_message="*;*" OR ocpp_message="*|*" OR ocpp_message="*`*" OR process="unexpected_command")