A critical command injection vulnerability in ChargePoint Home Flex 5.5.4.13 allows local authenticated users to achieve arbitrary command execution, posing a significant risk to device integrity.

The vulnerability exists due to a failure to properly validate a user-controlled string during bz2 decompression. An attacker with local access can leverage this flaw to execute arbitrary commands with the privileges of the nobody user.

The ability for an attacker to execute arbitrary commands on the ChargePoint Home Flex device presents a severe security risk, potentially leading to a total compromise of the unit's functionality. With a CVSS score of 7.8, this high-severity vulnerability could allow an attacker to disrupt charging services or pivot to other network segments, resulting in operational downtime and potential reputational damage for the organization.

Immediate Action: Update the ChargePoint Home Flex firmware to the latest available version that addresses this command injection flaw.

Proactive Monitoring: Review system access logs for any anomalous process execution or unexpected file decompression activities initiated by low-privileged users.

Compensating Controls: Restrict physical and logical access to the device to authorized personnel only to prevent attackers from establishing the local access required to trigger this vulnerability.

Public Exploit Available: Yes — a public proof-of-concept exists via the researcher's GitHub repository.

Given the potential for command execution and the availability of a public proof-of-concept, this vulnerability should be prioritized for remediation. Administrators must identify all instances of the affected version and apply the vendor-supplied firmware update immediately to prevent unauthorized system control.