EUVD-2026-21643Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted OCPP message to ChargePoint device
-
ExploitInject shell commands in unvalidated string parameter
-
ExecutionExecute arbitrary system call as root
-
ImpactAchieve remote code execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Network-adjacent attacker without authentication required. Targets ChargePoint Home Flex devices processing OCPP (Open Charge Point Protocol) messages. Vulnerability exists in revssh service command injection handling. No user interaction needed. Attacker must be on same local network segment (AV:A indicates network-adjacent access requirement). |
| Impact | Network-adjacent unauthenticated RCE with root code execution on ChargePoint Home Flex devices via OCPP message command injection. High impact (confidentiality, integrity, availability) tempered by AC:H complexity requirement. Limited to adjacent network access, reducing exposure scope compared to internet-facing threats. Device-specific deployment constraints further limit blast radius. |
| Exploit ScenarioDerived | Attacker on local network crafts malicious OCPP message with injected shell commands in unvalidated string field. ChargePoint device processes message without sanitization, executing arbitrary commands as root. No authentication required; no public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 11, 2026
Remote code execution via command injection in ChargePoint Home Flex electric vehicle charging stations allows unauthenticated network-adjacent attackers to execute arbitrary commands as root. The vulnerability resides in the revssh service's handling of OCPP (Open Charge Point Protocol) messages, where unsanitized user-supplied strings are passed directly to system calls. No authentication is required, but the attacker must be on the same network segment as the charging device. No public exploit identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis. Organizations should immediately implement network segmentation to isolate affected ChargePoint Home Flex devices on dedicated VLAN segments with strict firewall rules preventing lateral movement. Disable external OCPP connectivity if not operationally required. Monitor device logs for anomalous revssh service activity or unexpected system call patterns. Restrict network-adjacent access through 802.1X authentication or MAC address filtering on charging station network segments. Consult vendor advisory and contact ChargePoint support for firmware update availability and deployment timeline. Full technical details available at https://www.zerodayinitiative.com/advisories/ZDI-26-197/ and through ChargePoint's security response channels.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 OS command injection in revssh service. OCPP message parameters lack input validation before being interpolated into system call execution contexts. Network-adjacent attack vector (CVSS AV:A) requires local network access but bypasses authentication barriers. High attack complexity (AC:H) suggests exploitation requires specific timing or environmental conditions.
Know when Home Flex gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (zdi) · only source for this CVE.
CVSS VectorVendor: zdi
DescriptionCVE.org
ChargePoint Home Flex revssh Service Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of OCPP messages. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26338.
Executive ViewAI
CVE-2026-4157 is a critical remote code execution vulnerability in ChargePoint Home Flex charging stations that allows unauthenticated attackers on the same network to execute arbitrary commands with root privileges. Organizations operating these devices face direct risk of infrastructure compromise, data theft, and operational disruption without network isolation controls in place.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Isolate charging stations on a dedicated VLAN with no access to corporate networks, sensitive data, or other IoT devices; (2) Restrict inbound and outbound network connectivity using firewall rules to only essential communication endpoints; (3) Disable the revssh service if operationally feasible; (4) Monitor network traffic to and from charging devices for anomalous command patterns; (5) Implement network access controls (MAC filtering, port security) on switches connecting charging devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
GitHub PoC
Exploit-DB