ChargePoint Home Flex Improper Certificate Validation Vulnerability Allowing Code Execution

A vulnerability exists in ChargePoint Home Flex charging stations, allowing network-adjacent attackers to compromise transport security. The issue arises from improper validation of the server's certificate, specifically related to the CURLOPT_SSL_VERIFYHOST setting. This flaw can be exploited without authentication and may be leveraged alongside other vulnerabilities to execute code with root privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution in the context of the root user.

Remediation

The vendor has stated that the vulnerability has been addressed, but verification is pending. As a mitigation strategy, it is recommended to restrict interaction with the application.