(Pwn2Own) ChargePoint Home Flex revssh Service Command Injection Remote Code Execution Vulnerability

March 16th, 2026
ZDI-26-197 ZDI-CAN-26338

CVE ID

CVE-2026-4157

CVSS Score

7.5 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Vendors

ChargePoint

Affected Products

Home Flex

Vulnerability Details

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of OCPP messages. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.

Additional Details

Fixed in CPH50 firmware version 5.5.4.22


Disclosure Timeline

  • 2025-03-06 - Vulnerability reported to vendor
  • 2026-03-16 - Coordinated public release of advisory
  • 2026-03-16 - Advisory Updated

Credit

Viettel Cyber Security

Back to Advisories