Description
The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp_j.c contains a stack buffer overflow in parse_getconfig_msg(). When handling a GetConfiguration request from the central system, the handler copied the attacker-controlled JSON "key" string into the caller's fixed 50-byte stack buffer (skey[CISTR50], declared in subsys/net/lib/ocpp/ocpp.c) using an unbounded strcpy(). The parsed key value points directly into the receive buffer, so its length is bounded only by the message size (CONFIG_OCPP_RECV_BUFFER_SIZE, default 2048).

The GetConfiguration message is delivered over the WebSocket connection that the charge point opens to its configured central system. The reader thread ocpp_wsreader() reads the message into ui->recv_buf and dispatches it to parse_getconfig_msg() via the PDU function table. An attacker who controls the central system endpoint, or a man-in-the-middle on an unencrypted connection, can send a GetConfiguration request whose "key" field exceeds 50 bytes and overflow the reader thread's stack with attacker-chosen bytes.

The consequence is a remotely triggerable stack smash on the OCPP reader thread: at minimum a denial of service, and plausibly remote code execution depending on build-time hardening such as stack canaries and MPU configuration. The fix replaces the strcpy() with a bounded strncpy(key, payload.key[0], CISTR50 - 1) followed by explicit NUL termination, matching the bounded copies already used by the sibling handlers.
Published: 2026-08-25
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The OCPP 1.6 client in Zephyr RTOS contains a stack buffer overflow in the GetConfiguration message handler. An attacker can send a GetConfiguration request with a ‘key’ field longer than 50 bytes, causing the handler to perform an unbounded strcpy into a fixed 50‑byte stack buffer. This overflow can corrupt return addresses or adjacent stack data, leading to a stack smash that may trigger a denial of service or, if hardening such as stack canaries is disabled, remote code execution. The vulnerability exists only in the specific OCPP client implementation before the applied patch.

Affected Systems

Zephyr RTOS, specifically subsys/net/lib/ocpp/ocpp_j.c in the OCPP 1.6 client module. Any Zephyr build that includes this module before commit afbf880b04188ae5 is affected. The fix is included in later releases that incorporate this commit.

Risk and Exploitability

The CVSS score of 9.8 highlights the severity. EPSS is not available, but the lack of mitigation in the code and the potential for exploitation in unencrypted WebSocket connections mean the likelihood of attack remains high. An attacker who controls the central system or can perform a man‑in‑the‑middle on an unencrypted WebSocket can construct a malicious GetConfiguration request with an oversized key to trigger the stack overflow. The vulnerability has not been listed in the CISA KEV catalog, though its high severity warrants immediate attention.

Generated by OpenCVE AI on August 25, 2026 at 05:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a Zephyr release that includes commit afbf880b04188ae5, which replaces the unsafe strcpy with a bounded copy.
  • Configure all OCPP WebSocket connections to use TLS or another encryption method to prevent man‑in‑the‑middle manipulation of GetConfiguration requests.
  • If an immediate upgrade is unavailable, enable stack canaries, MPU protection, or other memory hardening features in the Zephyr build and limit OCPP client communications to trusted central systems only.

Generated by OpenCVE AI on August 25, 2026 at 05:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 25 Aug 2026 05:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Tue, 25 Aug 2026 04:45:00 +0000

Type Values Removed Values Added
Description The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp_j.c contains a stack buffer overflow in parse_getconfig_msg(). When handling a GetConfiguration request from the central system, the handler copied the attacker-controlled JSON "key" string into the caller's fixed 50-byte stack buffer (skey[CISTR50], declared in subsys/net/lib/ocpp/ocpp.c) using an unbounded strcpy(). The parsed key value points directly into the receive buffer, so its length is bounded only by the message size (CONFIG_OCPP_RECV_BUFFER_SIZE, default 2048). The GetConfiguration message is delivered over the WebSocket connection that the charge point opens to its configured central system. The reader thread ocpp_wsreader() reads the message into ui->recv_buf and dispatches it to parse_getconfig_msg() via the PDU function table. An attacker who controls the central system endpoint, or a man-in-the-middle on an unencrypted connection, can send a GetConfiguration request whose "key" field exceeds 50 bytes and overflow the reader thread's stack with attacker-chosen bytes. The consequence is a remotely triggerable stack smash on the OCPP reader thread: at minimum a denial of service, and plausibly remote code execution depending on build-time hardening such as stack canaries and MPU configuration. The fix replaces the strcpy() with a bounded strncpy(key, payload.key[0], CISTR50 - 1) followed by explicit NUL termination, matching the bounded copies already used by the sibling handlers.
Title Stack buffer overflow in OCPP GetConfiguration key parsing
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-08-25T15:15:52.330Z

Reserved: 2026-06-24T15:29:23.253Z

Link: CVE-2026-13214

cve-icon Vulnrichment

Updated: 2026-08-25T15:15:47.365Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-25T05:17:20.060

Modified: 2026-08-26T16:59:23.267

Link: CVE-2026-13214

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-25T05:30:16Z

Weaknesses