CVE-2026-4156
Stack-Based Buffer Overflow in ChargePoint Home Flex Enables RCE
Publication date: 2026-04-11
Last updated on: 2026-04-27
Assigner: Zero Day Initiative
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| chargepoint | home_flex_cph50_firmware | to 5.5.4.22 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an attacker to execute arbitrary code with root privileges on the affected ChargePoint Home Flex EV charger, impacting confidentiality, integrity, and availability of the system.
Such a compromise could lead to unauthorized access to sensitive data or disruption of services, which may affect compliance with standards and regulations like GDPR and HIPAA that require protection of data confidentiality and system integrity.
However, the provided information does not explicitly detail the direct impact on compliance with these standards.
Can you explain this vulnerability to me?
CVE-2026-4156 is a stack-based buffer overflow vulnerability found in the ChargePoint Home Flex electric vehicle charger. It occurs due to improper validation of the length of user-supplied data before copying it into a fixed-length stack buffer during the handling of Open Charge Point Protocol (OCPP) messages.
This flaw allows an attacker who is on a network adjacent to the device to execute arbitrary code remotely without needing to authenticate. The attacker can run code with root privileges, potentially taking full control of the affected device.
How can this vulnerability impact me? :
This vulnerability can have severe impacts as it allows an attacker to execute arbitrary code with root privileges on the affected ChargePoint Home Flex EV charger.
- Compromise of device confidentiality, integrity, and availability.
- Potential unauthorized control over the EV charger, which could disrupt charging operations.
- Since no authentication is required, the attack surface is broad for anyone on an adjacent network.