CVE-2026-4157 Overview
CVE-2026-4157 is a command injection vulnerability affecting ChargePoint Home Flex electric vehicle charging devices. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations without requiring authentication. The flaw exists within the handling of OCPP (Open Charge Point Protocol) messages in the revssh service, where improper validation of user-supplied strings before use in system calls enables attackers to execute commands with root privileges.
Critical Impact
Network-adjacent attackers can achieve unauthenticated remote code execution with root privileges on ChargePoint Home Flex devices, potentially compromising the entire charging infrastructure and connected home networks.
Affected Products
- ChargePoint Home Flex EV Charging Devices
- Devices running vulnerable firmware with the revssh service
- Systems processing OCPP messages without proper input validation
Discovery Timeline
- 2026-04-11 - CVE CVE-2026-4157 published to NVD
- 2026-04-13 - Last updated in NVD database
Technical Details for CVE-2026-4157
Vulnerability Analysis
This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The flaw resides in the revssh service component of ChargePoint Home Flex devices, specifically in how the service processes incoming OCPP messages.
The vulnerability arises because the application fails to properly sanitize user-controlled input before passing it to system shell commands. When processing OCPP protocol messages, the revssh service constructs system calls using data from these messages without adequate validation or escaping of special characters. This allows an attacker to inject arbitrary shell commands that execute in the context of the root user.
The attack requires network adjacency, meaning the attacker must be on the same network segment as the target device. However, no authentication is required, significantly lowering the barrier to exploitation. Given that EV chargers are often deployed on home or corporate networks with other sensitive systems, successful exploitation could provide attackers with a foothold for lateral movement.
Root Cause
The root cause of this vulnerability is the lack of proper input validation and sanitization in the revssh service when handling OCPP message parameters. The service directly incorporates user-supplied strings into system calls without neutralizing shell metacharacters such as semicolons, pipes, backticks, or command substitution syntax. This design flaw allows attackers to break out of the intended command context and execute arbitrary commands.
Attack Vector
The attack vector requires network-adjacent access to the ChargePoint Home Flex device. An attacker on the same local network segment can craft malicious OCPP protocol messages containing shell metacharacters and command payloads. When the vulnerable revssh service processes these messages, the injected commands execute with root privileges on the underlying Linux-based operating system.
The attack flow involves:
- Attacker gains access to the same network as the target ChargePoint device
- Attacker crafts malicious OCPP messages with embedded shell commands
- The revssh service receives and processes the malicious message
- User-controlled input is passed unsanitized to a system call
- Injected commands execute with root privileges
For detailed technical information about this vulnerability, refer to the Zero Day Initiative Advisory ZDI-26-197.
Detection Methods for CVE-2026-4157
Indicators of Compromise
- Unusual outbound network connections from ChargePoint devices to unknown external IP addresses
- Unexpected processes spawning from the revssh service or its parent processes
- Modifications to system files or creation of new user accounts on the device
- Anomalous OCPP message traffic patterns or malformed protocol messages in network logs
Detection Strategies
- Monitor network traffic for suspicious OCPP protocol messages containing shell metacharacters or command sequences
- Deploy network intrusion detection rules to identify command injection patterns in OCPP communications
- Implement network segmentation monitoring to detect lateral movement attempts from IoT device subnets
- Review device logs for evidence of unauthorized command execution or privilege escalation
Monitoring Recommendations
- Isolate EV charging infrastructure on dedicated network segments with strict ingress/egress filtering
- Enable comprehensive logging on network devices monitoring ChargePoint traffic
- Deploy endpoint detection capabilities capable of monitoring IoT and embedded device behavior
- Establish baseline network behavior for charging devices to detect anomalous communications
How to Mitigate CVE-2026-4157
Immediate Actions Required
- Isolate ChargePoint Home Flex devices on a separate VLAN with restricted network access
- Implement firewall rules to limit which systems can communicate with charging devices
- Disable remote management features if not required for operations
- Monitor for firmware updates from ChargePoint addressing this vulnerability
Patch Information
Organizations should monitor ChargePoint's official security communications and the Zero Day Initiative Advisory ZDI-26-197 for updates on patches addressing this vulnerability. Apply firmware updates as soon as they become available from ChargePoint.
Workarounds
- Segment the network to ensure charging devices are isolated from critical infrastructure and user workstations
- Implement strict access controls limiting which devices can send OCPP messages to the charger
- Deploy network access control (NAC) solutions to prevent unauthorized devices from joining the charging network
- Consider disabling the revssh service if it is not required for operational purposes and the device firmware allows it
# Network segmentation example - isolate IoT devices
# Create dedicated VLAN for EV charging infrastructure
# Configure firewall rules to restrict OCPP traffic sources
iptables -A INPUT -i eth0 -p tcp --dport 8080 -s 192.168.100.0/24 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 8080 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
