A stack-based buffer overflow flaw has been discovered in the handling of OCPP messages on ChargePoint Home Flex EV chargers. The vulnerability stems from an absence of proper length validation for user‑supplied data before it is copied into a fixed‑size stack buffer. An attacker can exploit this flaw to inject arbitrary code, which the system then executes with root privileges. The vulnerability is classified as a CWE‑121 type buffer overflow and does not require any authentication to be successfully leveraged.

The flaw affects all ChargePoint Home Flex EV chargers. No specific firmware or hardware model information is disclosed, so any installation of ChargePoint Home Flex that processes OCPP getpreq messages is potentially vulnerable.

With a CVSS score of 7.5, the vulnerability is considered high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can potentially reach the target over the network without authentication, leveraging the remote OCPP interface. If the vulnerability is successfully exploited, the attacker gains full control of the charger device, compromising its integrity and potentially enabling broader attacks on connected infrastructure.