Description
The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) using a hand-rolled helper, extract_string_field(), that copied the message's uid and action fields with strncpy(out_buf, token + 1, outlen - 1) and then scanned the result with strchr(out_buf, '"'). Because strncpy does not NUL-terminate the destination when the source is at least outlen - 1 (127) bytes long, the subsequent strchr reads past the 128-byte destination buffer into adjacent stack memory; if a " byte is found beyond the buffer, a one-byte out-of-bounds NUL write also occurs. A related defect in extract_payload() runs strchr/strrchr over the receive buffer, which may not be NUL-terminated when a maximal-length frame fills it.

The parsed bytes come directly from the OCPP central-system server over a websocket: the reader thread fills recv_buf via websocket_recv_msg() and calls parse_rpc_msg() on each inbound DATA frame (subsys/net/lib/ocpp/ocpp.c). A malicious or compromised central server, or an on-path attacker (OCPP is commonly deployed over plain ws://), can send an RPC frame whose uid or action field is 127+ bytes with no closing quote, triggering the out-of-bounds access.

The primary impact is a remotely triggerable denial of service: the unbounded scan can fault on an unmapped page, and the stray NUL write can corrupt adjacent stack state. The over-read data is not reflected to the peer, so disclosure is limited. The feature is EXPERIMENTAL and must be explicitly enabled (CONFIG_OCPP). The fix replaces the manual parser with the bounds-respecting json_mixed_arr_parse() and copies the extracted uid with an explicitly NUL-terminated buffer, eliminating both over-reads.
Published: 2026-08-02
Score: 7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The OCPP 1.6 client in Zephyr’s networking subsystem uses a hand‑rolled string extractor that copies the uid and action fields with strncpy without guaranteeing NUL termination. Subsequent strchr scans read past the 128‑byte stack buffer and may also write an unintended NUL byte beyond it. This out‑of‑bounds read or write does not leak data but can corrupt stack state or cause a crash, giving an attacker a remotely triggerable denial of service on a device running the experimental OCPP client.

Affected Systems

The vulnerability resides in the Zephyr Project’s Zephyr kernel, specifically subsys/net/lib/ocpp/ocpp_j.c and ocpp.c, and is enabled only when CONFIG_OCPP is set. Any Zephyr build that provides the experimental OCPP 1.6 client before the patch commit e500f7b is affected, regardless of the specific release version.

Risk and Exploitability

The CVSS score of 7.0 indicates a moderate severity. EPSS is not available, suggesting no calculated exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. An attacker who controls or can influence an OCPP central system, or who sits on the network path using plain ws:// connections, can send a malicious RPC frame containing an overly long uid or action field without a closing quote. The lack of authentication on standard OCPP websockets makes this straightforward, producing a simple denial of service rather than disclosure or privilege escalation.

Generated by OpenCVE AI on August 3, 2026 at 09:11 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Zephyr to a release that includes commit e500f7b or apply the corresponding patch to replace the custom parser with bounds‑respecting code.
  • If the OCPP client is not required, disable CONFIG_OCPP in the build configuration to eliminate the vulnerable code path.
  • Use secure websockets (wss://) and enforce authentication between the host and the OCPP central system to reduce exposure to malicious frames.

Generated by OpenCVE AI on August 3, 2026 at 09:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 02 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Sun, 02 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Description The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) using a hand-rolled helper, extract_string_field(), that copied the message's uid and action fields with strncpy(out_buf, token + 1, outlen - 1) and then scanned the result with strchr(out_buf, '"'). Because strncpy does not NUL-terminate the destination when the source is at least outlen - 1 (127) bytes long, the subsequent strchr reads past the 128-byte destination buffer into adjacent stack memory; if a " byte is found beyond the buffer, a one-byte out-of-bounds NUL write also occurs. A related defect in extract_payload() runs strchr/strrchr over the receive buffer, which may not be NUL-terminated when a maximal-length frame fills it. The parsed bytes come directly from the OCPP central-system server over a websocket: the reader thread fills recv_buf via websocket_recv_msg() and calls parse_rpc_msg() on each inbound DATA frame (subsys/net/lib/ocpp/ocpp.c). A malicious or compromised central server, or an on-path attacker (OCPP is commonly deployed over plain ws://), can send an RPC frame whose uid or action field is 127+ bytes with no closing quote, triggering the out-of-bounds access. The primary impact is a remotely triggerable denial of service: the unbounded scan can fault on an unmapped page, and the stray NUL write can corrupt adjacent stack state. The over-read data is not reflected to the peer, so disclosure is limited. The feature is EXPERIMENTAL and must be explicitly enabled (CONFIG_OCPP). The fix replaces the manual parser with the bounds-respecting json_mixed_arr_parse() and copies the extracted uid with an explicitly NUL-terminated buffer, eliminating both over-reads.
Title Out-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg)
Weaknesses CWE-125
CWE-787
References
Metrics cvssV3_1

{'score': 7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-08-03T14:55:27.603Z

Reserved: 2026-06-04T12:16:34.966Z

Link: CVE-2026-10848

cve-icon Vulnrichment

Updated: 2026-08-03T14:55:22.802Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-02T17:16:58.163

Modified: 2026-08-10T14:08:43.007

Link: CVE-2026-10848

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T09:15:03Z

Weaknesses