EUVD-2026-21641
GHSA-93fc-f6pw-cp83
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious OCPP message with oversized data
-
ExploitSend to ChargePoint Home Flex via network
-
ExecutionOverflow stack buffer in message handler
-
ImpactExecute arbitrary code as root
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Network-adjacent attacker sending malformed OCPP getpreq messages to ChargePoint Home Flex EV charger. No authentication required. Requires specific OCPP message crafting to trigger stack buffer overflow in message length validation. Default OCPP port exposure on local network/adjacent segment needed. |
| Impact | CVSS 7.5 reflects high impact (root RCE) but mitigated by network-adjacent requirement and high attack complexity. Unauthenticated exploitation of EV chargers creates persistent infrastructure risk. Moderate observed exploitation activity. Priority depends on deployment density in accessible networks and vendor patch availability timeline. |
| Exploit ScenarioDerived | Attacker crafts oversized OCPP getpreq message on local network segment. Malformed length field bypasses validation, overflows stack buffer, and executes arbitrary code with root privileges. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 11, 2026
Stack-based buffer overflow in ChargePoint Home Flex electric vehicle chargers enables network-adjacent attackers to execute arbitrary code as root via malformed OCPP messages. Unauthenticated exploitation allows complete device compromise through improper length validation in OCPP getpreq message handling. Attack complexity is high (CVSS AC:H), requiring local network access. No public exploit identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis. Organizations should immediately isolate ChargePoint Home Flex chargers on segregated network segments with strict firewall rules blocking unauthenticated OCPP message ingress from untrusted sources. Disable remote OCPP protocol access if operationally feasible. Implement network-level authentication and encrypted tunnels (VPN/TLS) for required OCPP communications. Monitor vendor security advisories for firmware updates. Full technical details available in Zero Day Initiative advisory: https://www.zerodayinitiative.com/advisories/ZDI-26-196/ - consult this resource for additional mitigation guidance and coordinate with ChargePoint support for patch timeline.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-121 stack buffer overflow in OCPP protocol message parser. Fixed-length stack buffer receives unbounded user data from OCPP getpreq commands without size validation, enabling controlled memory corruption and arbitrary code execution. Root execution context amplifies impact to full system control.
Know when Home Flex gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (zdi) · only source for this CVE.
CVSS VectorVendor: zdi
DescriptionCVE.org
ChargePoint Home Flex OCPP getpreq Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex EV chargers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of OCPP messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26339.
Executive ViewAI
ChargePoint Home Flex electric vehicle chargers contain a stack-based buffer overflow vulnerability (CVE-2026-4156) that allows unauthenticated attackers on the local network to execute arbitrary code with root privileges, potentially compromising the charger's control systems and connected vehicle charging infrastructure. Organizations operating these devices face operational disruption and unauthorized access risks until a patch is available.
Implement network segmentation to restrict charger access to trusted networks only; disable remote management interfaces if not operationally required; deploy network-level monitoring on charger segments to detect anomalous OCPP traffic patterns; maintain physical access controls to charger installation locations to limit local network threat actors.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB