CVE-2026-4155

OVERVIEW CVE-2026-4155 is an information disclosure vulnerability affecting ChargePoint Home Flex charging stations. The flaw exists in the genpw script, which contains a hardcoded secret cryptographic seed value in its source code. This allows attackers to extract sensitive information and stored credentials from affected installations without requiring authentication. SEVERITY This vulnerability carries a CVSS score of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction. While the attack complexity is low and the vulnerability has high impact on confidentiality, it does not affect system integrity or availability. The exposure of cryptographic seed values and stored credentials could facilitate lateral movement and further system compromise. The FAUCET Risk Score of 48/100 reflects moderate concern, though the EPSS percentile of 0.285% indicates this threat ranks below most disclosed vulnerabilities. EXPLOITATION STATUS There is no evidence of active exploitation at this time, as the vulnerability is not listed on the Known Exploited Vulnerabilities catalog and appears inactive on threat intelligence watch lists. Community attention and exploit code availability appear limited based on available indicators. Organizations should nonetheless prioritize patching to prevent potential abuse of the disclosed cryptographic material.