CVE-2026-4155: ChargePoint Home Flex Info Disclosure Flaw

CVE-2026-4155 Overview

CVE-2026-4155 is an information disclosure vulnerability affecting ChargePoint Home Flex electric vehicle charging stations. This vulnerability allows remote attackers to disclose sensitive information on affected installations without requiring authentication. The flaw exists within the genpw script, which contains a secret cryptographic seed value embedded directly in the source code. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise of the charging station and potentially connected systems.

Critical Impact

Remote unauthenticated attackers can extract cryptographic seed values from the genpw script, enabling credential disclosure and subsequent unauthorized access to ChargePoint Home Flex charging stations.

Affected Products

• ChargePoint Home Flex Charging Stations

Discovery Timeline

• April 11, 2026 - CVE-2026-4155 published to NVD
• April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-4155

Vulnerability Analysis

This vulnerability is classified as CWE-540 (Inclusion of Sensitive Information in Source Code), a critical secure coding flaw where developers embed sensitive cryptographic material directly within application source code. In the context of IoT devices like the ChargePoint Home Flex, this represents a significant security oversight that undermines the entire credential protection mechanism.

The genpw script is responsible for password generation functionality within the charging station's firmware. By including a static cryptographic seed value within this script, the security of all generated passwords becomes dependent on the secrecy of the firmware itself—a fundamentally flawed assumption given that firmware can be extracted, reverse-engineered, or exposed through various attack vectors.

Since no authentication is required to exploit this vulnerability, attackers with network access to the charging station can remotely extract this sensitive information. The network-accessible nature of the vulnerability significantly increases its exploitability, as attackers do not need physical access to the device.

Root Cause

The root cause of this vulnerability is the hardcoding of a secret cryptographic seed value within the genpw script. This practice violates secure development principles that mandate sensitive cryptographic material should never be stored in source code. Instead, such values should be generated dynamically, stored in secure hardware enclaves, or managed through proper key management systems.

The inclusion of cryptographic seeds in source code creates several security problems: the seed becomes identical across all deployed devices, the seed cannot be rotated without firmware updates, and any compromise of the firmware immediately reveals the cryptographic foundation for credential generation.

Attack Vector

The attack vector is network-based, allowing remote exploitation without authentication. An attacker can access the vulnerable genpw script over the network to extract the embedded cryptographic seed value. Once obtained, this seed enables the attacker to reverse-engineer or predict credentials generated by the charging station, potentially including Wi-Fi passwords, API keys, or administrative credentials.

The attack flow typically involves: network reconnaissance to identify ChargePoint Home Flex devices, accessing the genpw script to extract the cryptographic seed, and using the seed to derive or predict stored credentials for unauthorized access to the charging infrastructure.

Detection Methods for CVE-2026-4155

Indicators of Compromise

• Unusual network connections to ChargePoint Home Flex devices from untrusted sources
• Unexpected access attempts to firmware files or scripts on the charging station
• Authentication failures followed by successful logins using predicted credentials
• Network scanning activity targeting ChargePoint device ports

Detection Strategies

• Monitor network traffic for reconnaissance patterns targeting EV charging infrastructure
• Implement network segmentation to isolate charging stations from critical infrastructure
• Deploy intrusion detection systems with rules for IoT device exploitation attempts
• Log and analyze all access attempts to charging station management interfaces

Monitoring Recommendations

• Establish baseline network behavior for ChargePoint Home Flex devices and alert on anomalies
• Monitor for firmware extraction attempts or unauthorized access to device file systems
• Track authentication patterns to identify potential credential compromise scenarios
• Implement SIEM correlation rules for IoT-specific attack indicators

How to Mitigate CVE-2026-4155

Immediate Actions Required

• Isolate ChargePoint Home Flex charging stations on a dedicated network segment
• Implement strict firewall rules limiting network access to charging stations
• Rotate any credentials that may have been generated using the compromised seed
• Monitor affected devices for signs of unauthorized access or credential abuse

Patch Information

Consult the Zero Day Initiative Advisory ZDI-26-195 for the latest information on available patches and vendor remediation guidance. Contact ChargePoint support for firmware updates that address this vulnerability.

Workarounds

• Deploy network access controls to restrict who can communicate with charging stations
• Place charging infrastructure behind a VPN or zero-trust network architecture
• Use additional authentication layers for charging station management access
• Consider physical security measures to prevent local network access to devices

Network isolation represents the most effective mitigation strategy until a vendor patch is available. Administrators should implement firewall rules that only allow necessary communications to and from the charging stations, blocking all unnecessary network access.