ChargePoint Home Flex version 5.5.4.13 contains a stack-based buffer overflow vulnerability (CWE-121) in the processing of OCPP getpreq messages. The vulnerability is due to insufficient validation of the length of user-supplied data before copying it to a fixed-size stack buffer, enabling remote code execution at root level by network-adjacent attackers without authentication. The CVSS 3.0 score is 7.5, reflecting high impact on confidentiality, integrity, and availability. No official remediation or patch has been disclosed by the vendor as of the publication date.

Successful exploitation allows an unauthenticated, network-adjacent attacker to execute arbitrary code with root privileges on affected ChargePoint Home Flex EV chargers. This compromises the confidentiality, integrity, and availability of the device, potentially leading to full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected devices to trusted sources only and monitor for suspicious activity related to OCPP message handling. Avoid exposing the device to untrusted networks.