CVE-2024-23968

High

Published: 31 January 2025

Published

31 January 2025

Modified

30 September 2025

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0010 27.8th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-23968 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Chargepoint Home Flex Nema 14-50 Plug Firmware. Its CVSS base score is 8.8 (High).

Operationally, ranked at the 27.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Requires validation of user-supplied data lengths and formats prior to processing, directly addressing the lack of length validation in SrvrToSmSetAutoChnlListMsg that causes the buffer overflow.

SI-16 Memory Protection good match

prevent

Implements memory protections such as stack canaries, non-executable stacks, and address space randomization to prevent exploitation of stack-based buffer overflows for arbitrary code execution.

SC-7 Boundary Protection partial match

prevent

Monitors and controls communications at system boundaries to block unauthorized network-adjacent crafted packets required to trigger the unauthenticated buffer overflow.

NVD Description

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SrvrToSmSetAutoChnlListMsg function. The issue results from the lack…

of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.

Deeper analysisAI

CVE-2024-23968 is a buffer overflow vulnerability (CWE-120) in ChargePoint Home Flex charging stations. The flaw resides in the SrvrToSmSetAutoChnlListMsg function, where user-supplied data length is not properly validated before being copied into a fixed-length stack-based buffer. This issue enables network-adjacent attackers to execute arbitrary code without authentication, earning a CVSS v3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Network-adjacent attackers can exploit this vulnerability by sending crafted packets to the affected charging station. No privileges or user interaction are required, allowing remote code execution in the context of root. This grants full control over the device, with high impacts on confidentiality, integrity, and availability.

The Zero Day Initiative advisory (ZDI-24-1050) provides further details at https://www.zerodayinitiative.com/advisories/ZDI-24-1050/.