CVEvulnerability

CVE-2026-4155

7.5 HIGH Published 2026-04-11 Modified 2026-10-26 Official page ↗
Status
Analyzed
Published
2026-04-11
Last modified
2026-10-26
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-540

Description

ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the genpw script. The issue results from the inclusion of a secret cryptographic seed value within the script. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-26340.

Affected configurations

• chargepoint home flex cph50 firmware (< 5.5.4.22)

Related

Weakness · CWE (1)

  • CWE-540 Inclusion of Sensitive Information in Source Code weakness

References