ChargePoint Home Flex Improper Access Control Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in ChargePoint Home Flex charging stations. This issue arises from improper access control in the onboardee module, allowing network-adjacent attackers to execute arbitrary code with root privileges. Notably, no authentication is required to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected device, with the executed code running in the context of the root user.

Remediation

According to the vendor, this vulnerability was patched in May 2024.