Is CVE-2026-4155 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4155 being exploited in the wild.

How severe is CVE-2026-4155?

High severity, with a CVSS score of 7.5, published 11 April 2026.

Which products and versions are affected?

ChargePoint Home Flex CPH50 Firmware versions prior to 5.5.4.22.

Is there a fix for CVE-2026-4155?

A patch was published on 2026-03-16: Coordinated public release of advisory and fix in version 5.5.4.22 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4155 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-4155?

Check whether you run Chargepoint Home Flex Cph50 or Chargepoint Home Flex Cph50 Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4155: ChargePoint Home Flex sensitive information disclosure in genpw script

CVE-2026-4155 · Severity: high · CVSS 7.5 · Published 2026-04-11

ChargePoint Home Flex electric vehicle charging stations contain a security flaw where sensitive cryptographic information is hardcoded into the device's software. A remote attacker can exploit this to uncover stored credentials without needing a password. This could allow an unauthorized user to gain further access to the charging station, potentially compromising user data or device operations.

Technologies: Chargepoint Home Flex Cph50, Chargepoint Home Flex Cph50 Firmware. Vendors: Chargepoint.

Quick answers

Is CVE-2026-4155 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4155 being exploited in the wild.
How severe is CVE-2026-4155?: High severity, with a CVSS score of 7.5, published 11 April 2026.
Which products and versions are affected?: ChargePoint Home Flex CPH50 Firmware versions prior to 5.5.4.22.
Is there a fix for CVE-2026-4155?: A patch was published on 2026-03-16: Coordinated public release of advisory and fix in version 5.5.4.22 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4155 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-4155?: Check whether you run Chargepoint Home Flex Cph50 or Chargepoint Home Flex Cph50 Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An information disclosure vulnerability exists in the ChargePoint Home Flex CPH50 firmware due to the inclusion of sensitive information in the source code (CWE-540). Specifically, the 'genpw' script contains a hardcoded secret cryptographic seed value. A remote, unauthenticated attacker can leverage this seed to derive or disclose stored credentials on the device. This flaw was identified during Pwn2Own and is fixed in firmware version 5.5.4.22.

Affected products

ChargePoint Home Flex CPH50 Firmware versions prior to 5.5.4.22

Timeline

2025-03-13: disclosed: Vulnerability reported to vendor during Pwn2Own
2026-03-16: patched: Coordinated public release of advisory and fix in version 5.5.4.22
2026-04-11: advisory: NVD advisory published

References

https://www.zerodayinitiative.com/advisories/ZDI-26-195/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.