CVE-2026-4155

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the genpw script. The issue results from the inclusion of a secret cryptographic seed value within the script. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-26340.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-540

Affected software

No affected versions have been published.

Timeline

Published: Apr 11, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-415519.1A vulnerability has been identified in ROS# (All versions < V2.2.2). Affected versions contain a path traversal vulnerability because user i CVE-2026-415527.5PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization. An unauthe CVE-2026-4155310.0PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of "data" parameter sanit CVE-2026-415547.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bricks Builder allows Reflected XSS. CVE-2026-415559.3Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions.CVE-2026-415566.5Subscriber Cross Site Scripting (XSS) in ProfilePress <= 4.16.13 versions.CVE-2026-415577.1Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions.CVE-2026-415587.5Subscriber Bypass Vulnerability in WP Migration Plugin DB & Files – WP Synchro <= 1.16.1 versions.CVE-2026-415597.5Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore <= 2.1.2 versions.CVE-2026-41567.5ChargePoint Home Flex OCPP getpreq Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjace CVE-2026-415607.5Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions.CVE-2026-415617.5Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions.