ChargePoint Home Flex Sensitive Information Disclosure Vulnerability

A vulnerability in ChargePoint Home Flex charging stations allows remote attackers to disclose sensitive information. The issue arises from the genpw script, which includes a secret cryptographic seed value. This vulnerability can be exploited to reveal stored credentials, potentially leading to further compromise. Authentication is not required to exploit this vulnerability.

Impact

Exploitation of this vulnerability could result in the unauthorized disclosure of sensitive information, specifically stored credentials, which could be used to compromise affected systems.

Remediation

Users can update to ChargePoint Home Flex firmware version 5.5.4.22 to address this vulnerability.