ChargePoint Home Flex Command Injection Remote Code Execution Vulnerability

A command injection vulnerability allowing remote code execution has been identified in ChargePoint Home Flex devices. This issue arises from improper validation of user-supplied strings in the handling of OCPP messages, enabling network-adjacent attackers to execute arbitrary code with root privileges. Notably, authentication is not required to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected device, with the executed code running in the context of the root user.

Remediation

Users can update to ChargePoint Home Flex firmware version 5.5.4.22 to address this vulnerability.