# CVE-2026-4157: ChargePoint Home Flex command injection in revssh service

Source: https://junglewise.ai/threats/cve-2026-4157-chargepoint-home-flex-command-injection-in-revssh-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-11. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-4157 · Severity: high · CVSS 7.5 · Published 2026-04-11

ChargePoint Home Flex is a smart home electric vehicle (EV) charging station. A security vulnerability in its communication service allows an attacker on the same local network to take complete control of the charger without needing a password. This could allow an attacker to disrupt vehicle charging, access the device's operating system, or use the charger as a foothold to attack other devices on the home network.

Technologies: [Chargepoint Home Flex Cph50](https://junglewise.ai/threats/technologies/home-flex-cph50), [Chargepoint Home Flex Cph50 Firmware](https://junglewise.ai/threats/technologies/home-flex-cph50-firmware). Vendors: [Chargepoint](https://junglewise.ai/threats/vendors/chargepoint).

## Quick answers

**Is CVE-2026-4157 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4157 being exploited in the wild.

**How severe is CVE-2026-4157?** High severity, with a CVSS score of 7.5, published 11 April 2026.

**Which products and versions are affected?** ChargePoint Home Flex CPH50 firmware versions prior to 5.5.4.22.

**Is there a fix for CVE-2026-4157?** A patch was published on 2026-03-16: Fixed in CPH50 firmware version 5.5.4.22 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4157 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-4157?** Check whether you run Chargepoint Home Flex Cph50 or Chargepoint Home Flex Cph50 Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in the revssh service of ChargePoint Home Flex EV chargers. The flaw is located within the handling of Open Charge Point Protocol (OCPP) messages, where the application fails to properly validate user-supplied strings before passing them to a system call. An unauthenticated attacker on the same local network (adjacent) can exploit this to execute arbitrary commands with root privileges. The vulnerability was identified during Pwn2Own and is addressed in firmware version 5.5.4.22.

## Affected products

- ChargePoint Home Flex CPH50 firmware versions prior to 5.5.4.22

## Timeline

- 2025-03-06: disclosed: Vulnerability reported to vendor
- 2026-03-16: patched: Fixed in CPH50 firmware version 5.5.4.22
- 2026-03-16: advisory: Coordinated public release of advisory by ZDI
- 2026-04-11: other: NVD publication date

## References

- [https://www.zerodayinitiative.com/advisories/ZDI-26-197/](https://www.zerodayinitiative.com/advisories/ZDI-26-197/)

## Related threats

- [ChargePoint Home Flex stack overflow in OCPP getpreq](https://junglewise.ai/threats/cve-2026-4156-chargepoint-home-flex-stack-overflow-in-ocpp-getpreq)
- [ChargePoint Home Flex sensitive information disclosure in genpw script](https://junglewise.ai/threats/cve-2026-4155-chargepoint-home-flex-sensitive-information-disclosure-in-genpw)