ChargePoint Home Flex OCPP Stack-Based Buffer Overflow Remote Code Execution Vulnerability

A stack-based buffer overflow vulnerability allowing remote code execution has been identified in ChargePoint Home Flex electric vehicle chargers. This issue arises from improper validation of user-supplied data lengths in OCPP messages, enabling network-adjacent attackers to execute arbitrary code with root privileges. Notably, no authentication is required to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected device, with the executed code running in the context of the root user.

Remediation

Users can update to ChargePoint Home Flex firmware version 5.5.4.22 to address this vulnerability.