ChargePoint Home Flex Stack-Based Buffer Overflow Remote Code Execution Vulnerability

A stack-based buffer overflow vulnerability has been identified in ChargePoint Home Flex charging stations, allowing network-adjacent attackers to execute arbitrary code. The issue arises in the SrvrToSmSetAutoChnlListMsg function, where user-supplied data is not properly validated before being copied to a fixed-length buffer. This vulnerability can be exploited without authentication, with the executed code running in the context of root.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected device, with the executed code running as the root user.

Remediation

According to the vendor, this vulnerability was patched in April 2024.