The specific flaw exists within the handling of OCPP messages. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26338.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| ChargePoint | Home Flex | unknown |
|
No data.
No data.
No data available yet.
No remediation available yet.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-26-197/ |
|
Sat, 11 Apr 2026 01:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | ChargePoint Home Flex revssh Service Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OCPP messages. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26338. | |
| Title | ChargePoint Home Flex revssh Service Command Injection Remote Code Execution Vulnerability | |
| Weaknesses | CWE-78 | |
| References |
| |
| Metrics |
cvssV3_0
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: zdi
Published:
Updated: 2026-04-11T00:16:38.871Z
Reserved: 2026-03-13T20:34:14.213Z
Link: CVE-2026-4157
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-04-11T01:16:17.487
Modified: 2026-04-11T01:16:17.487
Link: CVE-2026-4157
Redhat
No data.
OpenCVE Enrichment
No data.