CVE-2026-4157: RCE in ChargePoint Home Flex

The impact of CVE-2026-4157 is severe due to the ease of exploitation and the potential for complete system takeover. An attacker can leverage this vulnerability to execute arbitrary code in the context of root on the ChargePoint Home Flex device. This could allow them to steal sensitive data, modify device settings, disrupt charging operations, or even use the compromised device as a pivot point to attack other systems on the network. The lack of authentication required for exploitation significantly broadens the attack surface, making it accessible to a wide range of attackers.

1. Reserved2026-03-13
2. Published2026-04-11
3. Modified2026-04-13
4. EPSS updated2026-04-18

The primary mitigation for CVE-2026-4157 is to upgrade ChargePoint Home Flex devices to a patched version as soon as it becomes available from ChargePoint. Until the upgrade is possible, consider segmenting the network to limit the attacker's potential reach if the device is compromised. Network firewalls should be configured to restrict external access to the device's OCPP port. Monitor network traffic for suspicious OCPP messages, particularly those containing unusual or unexpected characters. While a direct WAF rule is unlikely, a proxy can be configured to inspect OCPP traffic for command injection patterns.