ChargePoint Home Flex revssh Service Command Injection Remote Code Execution Vulnerability

The impact of CVE-2026-4157 is severe due to the ease of exploitation and the potential for complete system takeover. An attacker can leverage this vulnerability to execute arbitrary code in the context of root on the ChargePoint Home Flex device. This could allow them to steal sensitive data, modify device settings, disrupt charging operations, or even use the compromised device as a pivot point to attack other systems on the network. The lack of authentication required for exploitation significantly broadens the attack surface, making it accessible to a wide range of attackers.

Organizations and individuals utilizing ChargePoint Home Flex devices, particularly those deployed in environments with limited network segmentation or exposed to untrusted networks, are at significant risk. Shared hosting environments where multiple users share a single ChargePoint Home Flex device are also particularly vulnerable.

• linux / server:

journalctl -u chargepoint-home-flex -f | grep -i "ocpp"

• linux / server:

ps aux | grep chargepoint-home-flex

• linux / server:

lsof -i :6443 # OCPP default port

1. 2026-04-11Disclosure

   disclosure

1. 予約済み2026-03-13
2. 公開日2026-04-11
3. 更新日2026-04-13
4. EPSS 更新日2026-04-18

The primary mitigation for CVE-2026-4157 is to upgrade ChargePoint Home Flex devices to a patched version as soon as it becomes available from ChargePoint. Until the upgrade is possible, consider segmenting the network to limit the attacker's potential reach if the device is compromised. Network firewalls should be configured to restrict external access to the device's OCPP port. Monitor network traffic for suspicious OCPP messages, particularly those containing unusual or unexpected characters. While a direct WAF rule is unlikely, a proxy can be configured to inspect OCPP traffic for command injection patterns.