HomeIntelligenceBrief
🛡️ VULNERABILITY BRIEF🟠 High🛡️ Vulnerability

Critical Information Disclosure in ChargePoint Home Flex (CVE-2026-4155) Exposes Credentials

ChargePoint’s Home Flex EV‑charging stations contain a hard‑coded cryptographic seed in the genpw script, allowing remote attackers to retrieve stored credentials without authentication. The flaw scores 7.5 on CVSS and is fixed in firmware 5.5.4.22. Third‑party risk teams must remediate quickly to prevent supply‑chain compromise.

🛡️ LiveThreat™ Intelligence · 📅 March 17, 2026· 📰 zerodayinitiative.com
🟠
Severity
High
🛡️
Type
Vulnerability
🎯
Confidence
High
🏢
Affected
2 sector(s)
Actions
5 recommended
📰
Source
zerodayinitiative.com

(CVE‑2026‑4155) ChargePoint Home Flex Sensitive Information Disclosure Vulnerability

What It Is – A source‑code information‑disclosure flaw in the genpw script of ChargePoint’s Home Flex EV‑charging station. The script embeds a secret cryptographic seed, allowing anyone on the Internet to retrieve stored credentials without authentication.

Exploitability – The vulnerability is network‑accessible (AV:N), requires no privileges (PR:N) or user interaction (UI:N). A public PoC exists in the advisory; CVSS 7.5 (High). No known active ransomware or worm, but the exposed credentials can be leveraged for further compromise of charging‑network management systems.

Affected Products – ChargePoint Home Flex charging stations (all firmware prior to CPH50 5.5.4.22).

TPRM Impact

  • Third‑party EV‑charging infrastructure may expose fleet‑operator credentials, creating a supply‑chain foothold.
  • Compromise of a charging station can cascade to the vendor’s cloud‑based management platform, affecting multiple customers.

Recommended Actions

  • Verify firmware version; upgrade immediately to CPH50 5.5.4.22 or later.
  • Conduct an inventory of all ChargePoint Home Flex units across the organization and any downstream partners.
  • Rotate any credentials stored on the devices and on the associated management portal.
  • Review network segmentation; isolate charging stations from critical corporate assets.
  • Add the CVE to your vulnerability‑management feed and monitor for any anomalous traffic to the genpw endpoint.

Source: Zero Day Initiative Advisory – ZDI‑26‑195

📰 Original Source
http://www.zerodayinitiative.com/advisories/ZDI-26-195/

This LiveThreat Intelligence Brief is an independent analysis. Read the original reporting at the link above.

🛡️

Monitor Your Vendor Risk with LiveThreat™

Get automated breach alerts, security scorecards, and intelligence briefs when your vendors are compromised.