CVE-2026-4156

CVE-2026-4156 is a stack-based buffer overflow vulnerability affecting ChargePoint Home Flex EV chargers that stems from improper validation of OCPP message length fields. The flaw allows network-adjacent attackers to execute arbitrary code with root privileges without requiring authentication. This vulnerability was originally tracked as ZDI-CAN-26339 and represents a critical weakness in the charger's message handling implementation. The vulnerability carries a CVSS 3.0 score of 7.5 (HIGH) with an adjacent network attack vector, high complexity, and no privilege requirements. Successful exploitation could result in complete compromise of affected chargers, granting attackers high-impact capabilities across confidentiality, integrity, and availability. The EPSS score of 0.0008 indicates relatively low probability of exploitation relative to other CVEs, though this does not diminish the severity if targeted. There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog. No public exploit code is readily available, and community attention remains limited. Organizations operating ChargePoint Home Flex installations should treat this as a moderate-priority vulnerability requiring patch deployment, though the imminent risk of widespread attacks appears low at present.