A critical information disclosure vulnerability in ChargePoint Home Flex charging stations allows unauthenticated remote attackers to extract sensitive credentials, posing a significant security risk.

This flaw is caused by the inclusion of a secret cryptographic seed value within the genpw script, which is accessible to unauthenticated remote attackers. An adversary can leverage this exposure to recover sensitive information and stored credentials from the affected hardware.

The ability for an unauthenticated attacker to remotely obtain credentials presents a severe risk of further unauthorized access to the charging infrastructure and associated network segments. With a CVSS score of 7.5, this high severity vulnerability could lead to significant data compromise and loss of administrative control over the affected devices.

Immediate Action: Contact ChargePoint support or monitor the vendor advisory portal to obtain and apply the necessary security updates to address the credential exposure in the genpw script.

Proactive Monitoring: Review device access logs for unusual requests directed at the internal script endpoints and monitor for any signs of unauthorized configuration changes or lateral movement.

Compensating Controls: Isolate affected charging stations within a dedicated, restricted VLAN and employ network firewalls to limit incoming traffic to only authorized management IP addresses.

Public Exploit Available: No — there is no confirmed public exploit or weaponized code currently available for this vulnerability.

Given the exposure of sensitive credentials, this vulnerability requires immediate attention. Security teams should prioritize patching the affected ChargePoint Home Flex units as soon as the vendor provides a resolution and implement strict network segmentation to minimize the attack surface until the update is applied.