The vulnerability resides in the genpw script of ChargePoint Home Flex charging stations, which includes a secret cryptographic seed value. Because the seed is exposed in the script, an attacker who can access the device can retrieve stored credentials without authentication, compromising the confidentiality of the system. This flaw is a classic instance of source code information disclosure (CWE‑540).

The affected product is ChargePoint Home Flex. No specific firmware or software version ranges are supplied in the advisory, so any installation using the genpw script is potentially vulnerable unless a patch has been applied.

The CVSS score of 7.5 indicates a high severity risk. The exploitation does not require authentication and a remote attacker can trigger the disclosure by accessing the station through its management interface or network. EPSS data is unavailable, but the lack of KEV listing suggests that widespread exploitation is not yet documented. Nevertheless, the combination of high severity and remote attackability means the risk is significant for operators who have not yet updated their devices.