ChargePoint Home Flex chargers contain a command injection flaw in the handling of Open Charge Point Protocol (OCPP) messages. The vulnerability arises from undefined validation of a user‑supplied string that is passed to a system call. An attacker can supply crafted data and cause the device to execute arbitrary code as the root user. This results in full compromise of the affected device, allowing the attacker to read, modify, or delete data, install persistent backdoors, and potentially disrupt charging services.

This vulnerability affects all ChargePoint Home Flex chargers deployed with the current firmware stack. No specific firmware versions are cited in the advisory, so any installation of a Home Flex charger is potentially exposed until a vendor‑issued fix is deployed.

The CVSS score of 7.5 indicates a high severity risk, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Authentication is not required, and the flaw can be triggered from a device on the same local network, making the likely attack vector network‑adjacent. An attacker with local network access can exploit the vulnerability without credentials, creating substantial risk for installations that are not isolated from untrusted traffic.