This vulnerability exists in the revssh service of ChargePoint Home Flex devices, specifically in the processing of OCPP messages. Due to improper neutralization of special elements in user-supplied input, an attacker can inject OS commands that are executed with root privileges. The flaw does not require authentication and can be triggered by a network-adjacent attacker. The CVSS 3.0 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability. No official fix or vendor advisory has been published yet.

Successful exploitation results in remote code execution with root privileges on affected ChargePoint Home Flex devices, potentially allowing full system compromise. Confidentiality, integrity, and availability of the device are all impacted. The vulnerability can be exploited without authentication by an attacker on the same network segment. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected device to trusted sources only and monitor for unusual activity. Avoid exposing the device to untrusted networks. No official mitigation or temporary fix has been published by the vendor.