# CVE-2026-4155: ChargePoint Home Flex sensitive information disclosure in genpw script

Source: https://junglewise.ai/threats/cve-2026-4155-chargepoint-home-flex-sensitive-information-disclosure-in-genpw  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-11. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-4155 · Severity: high · CVSS 7.5 · Published 2026-04-11

ChargePoint Home Flex electric vehicle charging stations contain a security flaw where sensitive cryptographic information is hardcoded into the device's software. A remote attacker can exploit this to uncover stored credentials without needing a password. This could allow an unauthorized user to gain further access to the charging station, potentially compromising user data or device operations.

Technologies: [Chargepoint Home Flex Cph50](https://junglewise.ai/threats/technologies/home-flex-cph50), [Chargepoint Home Flex Cph50 Firmware](https://junglewise.ai/threats/technologies/home-flex-cph50-firmware). Vendors: [Chargepoint](https://junglewise.ai/threats/vendors/chargepoint).

## Quick answers

**Is CVE-2026-4155 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4155 being exploited in the wild.

**How severe is CVE-2026-4155?** High severity, with a CVSS score of 7.5, published 11 April 2026.

**Which products and versions are affected?** ChargePoint Home Flex CPH50 Firmware versions prior to 5.5.4.22.

**Is there a fix for CVE-2026-4155?** A patch was published on 2026-03-16: Coordinated public release of advisory and fix in version 5.5.4.22 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4155 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-4155?** Check whether you run Chargepoint Home Flex Cph50 or Chargepoint Home Flex Cph50 Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability exists in the ChargePoint Home Flex CPH50 firmware due to the inclusion of sensitive information in the source code (CWE-540). Specifically, the 'genpw' script contains a hardcoded secret cryptographic seed value. A remote, unauthenticated attacker can leverage this seed to derive or disclose stored credentials on the device. This flaw was identified during Pwn2Own and is fixed in firmware version 5.5.4.22.

## Affected products

- ChargePoint Home Flex CPH50 Firmware versions prior to 5.5.4.22

## Timeline

- 2025-03-13: disclosed: Vulnerability reported to vendor during Pwn2Own
- 2026-03-16: patched: Coordinated public release of advisory and fix in version 5.5.4.22
- 2026-04-11: advisory: NVD advisory published

## References

- [https://www.zerodayinitiative.com/advisories/ZDI-26-195/](https://www.zerodayinitiative.com/advisories/ZDI-26-195/)

## Related threats

- [ChargePoint Home Flex command injection in revssh service](https://junglewise.ai/threats/cve-2026-4157-chargepoint-home-flex-command-injection-in-revssh-service)
- [ChargePoint Home Flex stack overflow in OCPP getpreq](https://junglewise.ai/threats/cve-2026-4156-chargepoint-home-flex-stack-overflow-in-ocpp-getpreq)