What is the CVSS score of CVE-2026-4156?

CVE-2026-4156 has a CVSS 3.0 base score of 7.5 (High). CVSS vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Home Flex are affected by CVE-2026-4156?

ChargePoint Home Flex electric vehicle chargers contain a stack-based buffer overflow vulnerability (CVE-2026-4156) that allows unauthenticated attackers on the local network to execute arbitrary…

How to fix or mitigate CVE-2026-4156?

Within 24 hours: Inventory all ChargePoint Home Flex chargers in your environment and document network connectivity. Within 7 days: Isolate affected chargers to a dedicated VLAN with strict ingress controls; restrict network access to only authorized administrative and vehicle communication interfaces. Within 30 days: Contact ChargePoint for patch availability and establish upgrade testing procedures; monitor vendor advisories for CVE-2026-4156 patch release.

Home Flex CVE-2026-4156

EUVD-2026-21641 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-04-11 zdi

GHSA-93fc-f6pw-cp83

RCE Buffer Overflow Stack Overflow Home Flex

7.5

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 17:52 vuln.today

cvss_changed

EUVD ID Assigned

Apr 11, 2026 - 01:00 euvd

EUVD-2026-21641

Analysis Generated

Apr 11, 2026 - 01:00 vuln.today

CVE Published

Apr 11, 2026 - 00:16 nvd

HIGH 7.5

DescriptionCVE.org

ChargePoint Home Flex OCPP getpreq Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex EV chargers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of OCPP messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26339.

AnalysisAI

Stack-based buffer overflow in ChargePoint Home Flex electric vehicle chargers enables network-adjacent attackers to execute arbitrary code as root via malformed OCPP messages. Unauthenticated exploitation allows complete device compromise through improper length validation in OCPP getpreq message handling. Attack complexity is high (CVSS AC:H), requiring local network access. No public exploit identified at time of analysis.

Technical ContextAI

CWE-121 stack buffer overflow in OCPP protocol message parser. Fixed-length stack buffer receives unbounded user data from OCPP getpreq commands without size validation, enabling controlled memory corruption and arbitrary code execution. Root execution context amplifies impact to full system control.

RemediationAI

No vendor-released patch identified at time of analysis. Organizations should immediately isolate ChargePoint Home Flex chargers on segregated network segments with strict firewall rules blocking unauthenticated OCPP message ingress from untrusted sources. Disable remote OCPP protocol access if operationally feasible. Implement network-level authentication and encrypted tunnels (VPN/TLS) for required OCPP communications. Monitor vendor security advisories for firmware updates. Full technical details available in Zero Day Initiative advisory: https://www.zerodayinitiative.com/advisories/ZDI-26-196/ - consult this resource for additional mitigation guidance and coordinate with ChargePoint support for patch timeline.