PT-2024-38320 · Chargepoint · Chargepoint Home Flex

Todd Manning · Published 2024-08-01 · Updated 2024-12-03 · CVE-2024-7392

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ChargePoint Home Flex (affected versions not specified)

Description This issue allows network-adjacent attackers to create a denial-of-service condition on affected installations of ChargePoint Home Flex charging devices. The specific flaw exists within the connection handling of the Bluetooth Low Energy interface, where limiting the number of active connections to the product can be exploited to create a denial-of-service condition. Authentication is not required to exploit this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-410

Related Identifiers

CVE-2024-7392

ZDI-24-1047

Affected Products

Chargepoint Home Flex

References · 5

• https://osv.dev/vulnerability/CVE-2024-7392 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-1047 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-7392 · Security Note
• https://twitter.com/dailycve/status/1864088641217110083 · Twitter Post
• https://twitter.com/CVEnew/status/1860199545461747945 · Twitter Post