CVE-2024-23921: (0Day) (Pwn2Own) ChargePoint Home Flex wlanapp Command Injection Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the wlanapp module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23921?
CVE-2024-23921 has a high severity rating due to the potential for arbitrary code execution by unauthenticated attackers.
How do I fix CVE-2024-23921?
To fix CVE-2024-23921, users should update their ChargePoint Home Flex firmware to the latest version provided by ChargePoint.
What systems are affected by CVE-2024-23921?
CVE-2024-23921 specifically affects ChargePoint Home Flex charging stations.
Can CVE-2024-23921 be exploited remotely?
Yes, CVE-2024-23921 can be exploited by network-adjacent attackers without the need for authentication.
What type of vulnerability is CVE-2024-23921?
CVE-2024-23921 is classified as a remote code execution vulnerability.