Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
ChargePoint Home Flex OCPP getpreq Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OCPP messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26339.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 2 products
| Date | Total | Labels |
|---|
| 2026-03-16 | 1 | Disclosure1 |
| 2026-03-17 | 1 | Disclosure1 |
| 2026-04-19 | 1 | Disclosure1 |
| 2026-04-21 | 1 | Patch1 |
CVE-2026-4156 ChargePoint Home Flex OCPP getpreq Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbi… https://www.cve.org/CVERecord?id=CVE-2026-4156
Post summary
The tweet announces CVE‑2026‑4156 as a stack‑based buffer overflow in ChargePoint Home Flex OCPP that enables remote code execution for network‑adjacent attackers.
[ZDI-26-196|CVE-2026-4156] (Pwn2Own) ChargePoint Home Flex OCPP getpreq Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.5; Credit: Synacktiv) https://www.zerodayinitiative.com/advisories/ZDI-26-196/
Post summary
The advisory announces CVE-2026-4156 as a stack‑based buffer overflow in ChargePoint Home Flex’s OCPP getpreq handling, allowing RCE (CVSS 7.5), with Proof of Concept demonstrated in Pwn2Own.
#ALERT CVE-2026-4156 (CVSS 7.5) - ChargePoint Home Flex EV chargers vulnerable to unauthenticated RCE via OCPP stack buffer overflow. Network-adjacent attackers can execute code as root. Patch immediately. #CVE #Vulnerability #PatchNow https://t.co/rflUTTMxQ8
Post summary
The tweet highlights ChargePoint Home Flex EV chargers vulnerable to an unauthenticated RCE via an OCPP stack buffer overflow (CVSS 7.5) and urges users to patch immediately.
A new vulnerability with increased severity was disclosed for ChargePoint Home Flex (CVE-2026-4156) https://vuldb.com/?id.351347
Post summary
The post announces the disclosure of a new vulnerability (CVE-2026-4156) affecting ChargePoint Home Flex with an increased severity rating, but provides no further technical details or exploitation information.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | chargepoint | home_flex_cph50 | - | - | - |
| OS | chargepoint | home_flex_cph50_firmware | - | - | - |