CVE-2026-4155

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4155", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "state": "PUBLISHED", "assignerShortName": "zdi", "dateReserved": "2026-03-13T20:33:53.560Z", "datePublished": "2026-04-11T00:16:25.621Z", "dateUpdated": "2026-04-13T17:23:38.780Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-04-11T00:16:25.621Z"}, "title": "ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information Disclosure Vulnerability", "descriptions": [{"lang": "en", "value": "ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the genpw script. The issue results from the inclusion of a secret cryptographic seed value within the script. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-26340."}], "affected": [{"vendor": "ChargePoint", "product": "Home Flex", "versions": [{"version": "5.5.4.13", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-540", "description": "CWE-540: Inclusion of Sensitive Information in Source Code", "type": "CWE"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-195/", "name": "ZDI-26-195", "tags": ["x_research-advisory"]}], "dateAssigned": "2026-03-13T20:33:53.610Z", "datePublic": "2026-03-16T21:29:21.211Z", "source": {"lang": "en", "value": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-13T17:23:30.308759Z", "id": "CVE-2026-4155", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T17:23:38.780Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4155", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T17:23:30.308759Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T17:23:34.981Z"}}], "cna": {"title": "ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information Disclosure Vulnerability", "source": {"lang": "en", "value": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "ChargePoint", "product": "Home Flex", "versions": [{"status": "affected", "version": "5.5.4.13"}], "defaultStatus": "unknown"}], "datePublic": "2026-03-16T21:29:21.211Z", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-195/", "name": "ZDI-26-195", "tags": ["x_research-advisory"]}], "dateAssigned": "2026-03-13T20:33:53.610Z", "descriptions": [{"lang": "en", "value": "ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the genpw script. The issue results from the inclusion of a secret cryptographic seed value within the script. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-26340."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-540", "description": "CWE-540: Inclusion of Sensitive Information in Source Code"}]}], "providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-04-11T00:16:25.621Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4155", "state": "PUBLISHED", "dateUpdated": "2026-04-13T17:23:38.780Z", "dateReserved": "2026-03-13T20:33:53.560Z", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "datePublished": "2026-04-11T00:16:25.621Z", "assignerShortName": "zdi"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Home Flex", "vendor": "ChargePoint", "versions": [{"status": "affected", "version": "5.5.4.13"}]}], "source": "zdi-disclosures@trendmicro.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:chargepoint:home_flex_cph50_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F5D6BCAE-C598-4884-ADB5-45B272220C2A", "versionEndExcluding": "5.5.4.22", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:chargepoint:home_flex_cph50:-:*:*:*:*:*:*:*", "matchCriteriaId": "2A6709D3-36B1-4027-82ED-144875049704", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the genpw script. The issue results from the inclusion of a secret cryptographic seed value within the script. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-26340."}, {"lang": "es", "value": "Vulnerabilidad de revelaci\u00f3n de informaci\u00f3n por inclusi\u00f3n de informaci\u00f3n sensible en el c\u00f3digo fuente de ChargePoint Home Flex. Esta vulnerabilidad permite a atacantes remotos revelar informaci\u00f3n sensible en instalaciones afectadas de estaciones de carga ChargePoint Home Flex. No se requiere autenticaci\u00f3n para explotar esta vulnerabilidad.\n\nLa falla espec\u00edfica existe dentro del script genpw. El problema resulta de la inclusi\u00f3n de un valor semilla criptogr\u00e1fico secreto dentro del script. Un atacante puede aprovechar esta vulnerabilidad para revelar credenciales almacenadas, lo que lleva a un compromiso adicional. Fue ZDI-CAN-26340."}], "id": "CVE-2026-4155", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4155", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-13T17:23:30.308759Z", "version": "2.0.3"}}]}, "published": "2026-04-11T01:16:17.230", "references": [{"source": "zdi-disclosures@trendmicro.com", "tags": ["Third Party Advisory"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-195/"}], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-540"}], "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.5.4.13,5.5.4.13]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Home Flex", "source": "cna", "vendor": "ChargePoint"}, "product": "home_flex", "vendor": "chargepoint"}], "analysis": {"en": {"generated_at": "2026-04-11T02:24:52.018837+00:00", "value": {"mitigation_remediation": ["Check the ChargePoint website or support contact for any available firmware or software updates that remove the exposed seed from the genpw script.", "If a patch is not yet released, locate the genpw script on the device\u2019s filesystem and remove or redact the embedded seed value before the script is made accessible to users.", "Apply any interim security controls, such as restricting network access to the charging station\u2019s management ports, disabling unnecessary services, and monitoring logs for attempts to read the script file.", "After remediation, verify that no sensitive data remains in accessible scripts and conduct a secondary scan to confirm the vulnerability has been remediated."], "summary": {"action": "Apply Patch", "impact": "Sensitive information disclosure leading to credential exposure"}, "threat_synthesis": {"affected_systems": "The affected product is ChargePoint Home Flex. No specific firmware or software version ranges are supplied in the advisory, so any installation using the genpw script is potentially vulnerable unless a patch has been applied.", "description_and_impact": "The vulnerability resides in the genpw script of ChargePoint Home Flex charging stations, which includes a secret cryptographic seed value. Because the seed is exposed in the script, an attacker who can access the device can retrieve stored credentials without authentication, compromising the confidentiality of the system. This flaw is a classic instance of source code information disclosure (CWE\u2011540).", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high severity risk. The exploitation does not require authentication and a remote attacker can trigger the disclosure by accessing the station through its management interface or network. EPSS data is unavailable, but the lack of KEV listing suggests that widespread exploitation is not yet documented. Nevertheless, the combination of high severity and remote attackability means the risk is significant for operators who have not yet updated their devices."}}}}, "created": "2026-04-13T12:42:10.951716+00:00", "updated": "2026-04-13T12:56:56.281758+00:00", "vendors": ["chargepoint", "chargepoint$PRODUCT$home_flex"]}