CVE-2026-4156: ChargePoint Home Flex OCPP RCE Vulnerability

CVE-2026-4156 Overview

CVE-2026-4156 is a stack-based buffer overflow vulnerability affecting ChargePoint Home Flex EV chargers. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations without requiring authentication. The flaw exists within the handling of OCPP (Open Charge Point Protocol) messages, specifically in the getpreq function where user-supplied data is improperly validated before being copied to a fixed-length stack-based buffer.

Critical Impact
Successful exploitation enables attackers to execute arbitrary code with root privileges on vulnerable ChargePoint Home Flex EV chargers, potentially compromising the entire charging infrastructure and connected systems.

Affected Products

ChargePoint Home Flex EV Chargers (specific versions not disclosed)

Discovery Timeline

2026-04-11 - CVE-2026-4156 published to NVD
2026-04-13 - Last updated in NVD database

Technical Details for CVE-2026-4156

Vulnerability Analysis

This vulnerability is classified as CWE-121 (Stack-based Buffer Overflow), a memory corruption flaw that occurs when a program writes more data to a stack-allocated buffer than it can hold. In the context of ChargePoint Home Flex devices, the vulnerability manifests in the OCPP message handling functionality.

The OCPP protocol is widely used for communication between EV charging stations and central management systems. The getpreq function within the charger firmware fails to properly validate the length of incoming user-supplied data before copying it to a fixed-length buffer allocated on the stack. This oversight allows an attacker to overflow the buffer with carefully crafted input.

Because the attack vector is adjacent network (requiring the attacker to be on the same network segment as the vulnerable device), exploitation requires proximity to the target device. However, once within range, no authentication is required to trigger the vulnerability, significantly lowering the barrier to exploitation. Successful exploitation results in code execution with root privileges, giving attackers complete control over the device.

Root Cause

The root cause of this vulnerability is improper input validation in the OCPP message parsing code. The getpreq handler accepts user-controlled data and copies it directly into a stack buffer without verifying that the data length does not exceed the buffer's capacity. This classic memory safety error allows attackers to overwrite adjacent stack memory, including return addresses and other critical control data.

Attack Vector

The attack requires network adjacency, meaning the attacker must have access to the same local network segment as the vulnerable ChargePoint Home Flex device. The attacker sends a specially crafted OCPP message to the charger containing oversized data in the getpreq request. When processed, this data overflows the stack buffer, corrupting the stack frame and allowing the attacker to redirect program execution to arbitrary code. The vulnerability can be exploited without authentication and results in code execution in the context of root.

For detailed technical information about this vulnerability, refer to the Zero Day Initiative Advisory ZDI-26-196.

Detection Methods for CVE-2026-4156

Indicators of Compromise

Unusual or malformed OCPP messages targeting ChargePoint Home Flex devices
Unexpected network traffic patterns on the local network segment where EV chargers are deployed
Anomalous process execution or file system changes on the charging device
Crash logs or error messages related to memory corruption in the OCPP handler

Detection Strategies

Deploy network intrusion detection systems (NIDS) to monitor OCPP traffic for oversized or malformed messages
Implement network segmentation to isolate EV charging infrastructure from general network traffic
Monitor for unusual command execution or privilege escalation attempts on IoT devices
Review firmware logs for signs of exploitation attempts or unexpected behavior

Monitoring Recommendations

Enable logging on network devices to capture all traffic to and from EV chargers
Implement anomaly detection for OCPP protocol communications
Regularly audit network segments containing IoT devices for unauthorized access points
Deploy SentinelOne Singularity to monitor endpoint behavior and detect exploitation attempts in real-time

How to Mitigate CVE-2026-4156

Immediate Actions Required

Isolate ChargePoint Home Flex devices on a dedicated network segment with restricted access
Implement strict network access controls to limit which devices can communicate with EV chargers
Monitor for any exploitation attempts using the detection strategies outlined above
Contact ChargePoint support for guidance on available patches or firmware updates

Patch Information

Patch information has not been publicly disclosed at this time. Organizations should monitor the Zero Day Initiative Advisory ZDI-26-196 and ChargePoint's official channels for updates regarding security fixes.

Workarounds

Segment EV charging infrastructure onto isolated VLANs with strict firewall rules
Restrict network access to only authorized management systems and personnel
Disable remote OCPP connectivity if not required for operations
Implement MAC address filtering to limit device access on the charging network

bash

# Example network segmentation configuration (generic firewall)
# Create dedicated VLAN for EV charging infrastructure
# Restrict inbound access to management IPs only
iptables -A INPUT -i eth0 -s 192.168.10.0/24 -p tcp --dport 8080 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 8080 -j DROP