CVE-2024-23971

High

Published: 31 January 2025

Published

31 January 2025

Modified

30 September 2025

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0011 28.2th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-23971 is a high-severity Command Injection (CWE-77) vulnerability in Chargepoint Home Flex Nema 14-50 Plug Firmware. Its CVSS base score is 8.8 (High).

Operationally, ranked at the 28.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly addresses the core flaw by requiring validation of user-supplied strings in OCPP messages before passing to system calls, preventing command injection.

SI-2 Flaw Remediation good match

prevent

Mandates identification, reporting, and correction of the specific command injection vulnerability in OCPP handling to eliminate the flaw.

AC-6 Least Privilege partial match

prevent

Mitigates impact of successful injection by enforcing least privilege, preventing arbitrary code execution in the root context.

NVD Description

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OCPP messages. The issue results from…

the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.

Deeper analysisAI

CVE-2024-23971 is a command injection vulnerability (CWE-77) affecting ChargePoint Home Flex charging stations. The flaw resides in the handling of OCPP messages, where a user-supplied string lacks proper validation before being passed to a system call. This enables network-adjacent attackers to execute arbitrary code in the context of root without requiring authentication.

Network-adjacent attackers can exploit the vulnerability with low complexity, no privileges, and no user interaction, as indicated by the CVSS vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (score 8.8). Successful exploitation allows full arbitrary code execution as root, potentially compromising the device's confidentiality, integrity, and availability.

The Zero Day Initiative advisory at https://www.zerodayinitiative.com/advisories/ZDI-24-1053/ provides further details on the issue, including potential mitigation guidance.