CVE-2026-4157

OVERVIEW: CVE-2026-4157 is a command injection vulnerability in the revssh service of ChargePoint Home Flex EV charging devices that allows unauthenticated network-adjacent attackers to execute arbitrary code with root privileges. The flaw stems from inadequate input validation of OCPP (Open Charge Point Protocol) messages before they are passed to system calls. SEVERITY: This vulnerability carries a HIGH CVSS score of 7.5, with an adjacent network attack vector and high complexity requirements. However, the impact is severe, as successful exploitation grants attackers complete system compromise through root-level code execution with high confidentiality, integrity, and availability impacts. EXPLOITATION STATUS: The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog and shows no signs of active exploitation in the wild. Community attention is minimal, with an EPSS score of 0.0025 indicating low probability of near-term exploitation. No public exploit code is known to be available at this time, though the lack of authentication requirements and the root-level access potential present significant long-term risk if exploitation techniques emerge.