Cyber Resilience

CVE-2026-4155

High

Published: 11 April 2026

Published
11 April 2026
Modified
27 April 2026
KEV Added
—
Patch
—
CVSS Score v3 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0077 73.9th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-4155 is a high-severity Inclusion of Sensitive Information in Source Code (CWE-540) vulnerability in Chargepoint Home Flex Cph50 Firmware. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 26.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The…

more

specific flaw exists within the genpw script. The issue results from the inclusion of a secret cryptographic seed value within the script. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-26340.

CWE(s)
CWE-540

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
attack.mitre.org →
Why these techniques?

Remote unauthenticated disclosure of hardcoded cryptographic seed enabling credential access on public-facing device.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

Affected Assets

chargepoint
home flex cph50 firmware
≤ 5.5.4.22

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

IR-9 Information Spillage Response
addresses: CWE-540

Detection and removal of spilled information addresses cases where sensitive data was included in source code.

SA-21 Developer Screening
addresses: CWE-540

Screening helps prevent intentional insertion of sensitive information into source code by untrusted developers.

SC-38 Operations Security
addresses: CWE-540

Prevents inclusion of sensitive information in source code and development artifacts through SDLC-wide OPSEC controls.

References