8.8

CVE-2024-23920

EPSS 0.09%
Veröffentlicht 31.01.2025 01:15:09
Zuletzt bearbeitet 01.07.2025 14:15:31
Quelle ics-cert@hq.dhs.gov
CVE-Watchlists
Login
Unerledigt
Login

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the onboardee module. The issue results from improper access control. An attacker can leverage this vulnerability to execute code in the context of root.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 4

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD

Diese Information steht angemeldeten Benutzern zur Verfügung.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Chargepoint ≫ Home Flex Nema 14-50 Plug Firmware Version-

Chargepoint ≫ Home Flex Nema 14-50 Plug Version-

Chargepoint ≫ Home Flex Hardwired Firmware Version-

Chargepoint ≫ Home Flex Hardwired Version-

Chargepoint ≫ Home Flex Nema 6-50 Plug Firmware Version-

Chargepoint ≫ Home Flex Nema 6-50 Plug Version-

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.09%	0.27

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
ics-cert@hq.dhs.gov	8.8	2.8	5.9	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

https://www.zerodayinitiative.com/advisories/ZDI-24-1048/

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2024-23920

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2024-23920

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2024-23920

EUVD