This vulnerability (CVE-2026-4155) affects ChargePoint Home Flex charging stations version 5.5.4.13. The flaw is due to the inclusion of a secret cryptographic seed value embedded in the genpw script, which can be accessed remotely without authentication. This results in the disclosure of sensitive information, specifically stored credentials, potentially enabling further compromise of the affected device. The vulnerability is categorized under CWE-540 (Inclusion of Sensitive Information in Source Code) and has a CVSS v3.0 base score of 7.5, indicating high severity. No official patch or remediation guidance has been provided by ChargePoint as of the publication date.

Successful exploitation allows remote attackers to disclose sensitive cryptographic seed values and stored credentials without requiring authentication. This can lead to unauthorized access or further compromise of the affected ChargePoint Home Flex charging stations. The confidentiality of sensitive information is severely impacted, but there is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to affected ChargePoint Home Flex devices to trusted users only and monitor for unauthorized access attempts. Avoid exposing the genpw script or related management interfaces to untrusted networks.