CVE-2026-4155 ChargePoint CVE debrief

Who should care

Defenders responsible for ChargePoint Home Flex charging stations, especially those exposed to the internet, should assess their exposure and prioritize remediation. Defenders need to verify and remediate this vulnerability to prevent potential exploitation and compromise. This vulnerability is a high-severity vulnerability in ChargePoint Home Flex charging stations that allows remote attackers to disclose sensitive information.

Why it matters

CVE-2026-4155 is a high-severity vulnerability in ChargePoint Home Flex charging stations that allows remote attackers to disclose sensitive information. Defenders should prioritize verifying and remediating this vulnerability, especially in internet-exposed systems, to prevent potential exploitation and compromise.

• Remote attackers can disclose sensitive information, potentially leading to further compromise.
• Defenders need to verify and remediate this vulnerability to prevent potential exploitation.
• The vulnerability can be exploited without authentication, increasing the risk of compromise.

Technical summary

The ChargePoint Home Flex charging station's genpw script contains a secret cryptographic seed value, which can be exploited by remote attackers to disclose sensitive information, potentially leading to further compromise. This vulnerability allows remote attackers to disclose sensitive information. The flaw exists in the genpw script, which includes a secret cryptographic seed value. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. The specific flaw exists within the genpw script.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in ChargePoint Home Flex charging stations, especially those exposed to the internet.

Recommended defensive actions

• Verify ChargePoint Home Flex charging stations for exposure to the internet and ensure they are running firmware version 5.5.4.22 or later.
• Review and update the genpw script to remove the secret cryptographic seed value.
• Monitor for potential exploitation attempts and implement additional security measures to protect against further compromise.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is confirmed to exist in ChargePoint Home Flex charging stations with firmware versions prior to 5.5.4.22. The genpw script contains a secret cryptographic seed value that can be exploited to disclose sensitive information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.