CVE-2026-13214

Stack buffer overflow in OCPP GetConfiguration key parsing

Published Aug 25, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp_j.c contains a stack buffer overflow in parse_getconfig_msg(). When handling a GetConfiguration request from the central system, the handler copied the attacker-controlled JSON "key" string into the caller's fixed 50-byte stack buffer (skey[CISTR50], declared in subsys/net/lib/ocpp/ocpp.c) using an unbounded strcpy(). The parsed key value points directly into the receive buffer, so its length is bounded only by the message size (CONFIG_OCPP_RECV_BUFFER_SIZE, default 2048).

The GetConfiguration message is delivered over the WebSocket connection that the charge point opens to its configured central system. The reader thread ocpp_wsreader() reads the message into ui->recv_buf and dispatches it to parse_getconfig_msg() via the PDU function table. An attacker who controls the central system endpoint, or a man-in-the-middle on an unencrypted connection, can send a GetConfiguration request whose "key" field exceeds 50 bytes and overflow the reader thread's stack with attacker-chosen bytes.

The consequence is a remotely triggerable stack smash on the OCPP reader thread: at minimum a denial of service, and plausibly remote code execution depending on build-time hardening such as stack canaries and MPU configuration. The fix replaces the strcpy() with a bounded strncpy(key, payload.key[0], CISTR50 - 1) followed by explicit NUL termination, matching the bounded copies already used by the sibling handlers.

Analysis

Technical impact

The OCPP 1.6 client in Zephyr RTOS contains a stack buffer overflow in the GetConfiguration message handler. An attacker can send a GetConfiguration request with a ‘key’ field longer than 50 bytes, causing the handler to perform an unbounded strcpy into a fixed 50‑byte stack buffer. This overflow can corrupt return addresses or adjacent stack data, leading to a stack smash that may trigger a denial of service or, if hardening such as stack canaries is disabled, remote code execution. The vulnerability exists only in the specific OCPP client implementation before the applied patch.

Affected Systems

Zephyr RTOS, specifically subsys/net/lib/ocpp/ocpp_j.c in the OCPP 1.6 client module. Any Zephyr build that includes this module before commit afbf880b04188ae5 is affected. The fix is included in later releases that incorporate this commit.

Risk and Exploitability

The CVSS score of 9.8 highlights the severity. EPSS is not available, but the lack of mitigation in the code and the potential for exploitation in unencrypted WebSocket connections mean the likelihood of attack remains high. An attacker who controls the central system or can perform a man‑in‑the‑middle on an unencrypted WebSocket can construct a malicious GetConfiguration request with an oversized key to trigger the stack overflow. The vulnerability has not been listed in the CISA KEV catalog, though its high severity warrants immediate attention.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

zephyrproject

zephyr

unaffected

Version	Status	Constraints
`4.3.0`	affected	< 4.3.2
`4.4.0`	affected	< 4.4.2

No data.

Vendor Product Versions

Zephyrproject

Zephyr

Version	Status	Scheme	Platform
`[4.3.0,4.4.2)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a Zephyr release that includes commit afbf880b04188ae5, which replaces the unsafe strcpy with a bounded copy.
Configure all OCPP WebSocket connections to use TLS or another encryption method to prevent man‑in‑the‑middle manipulation of GetConfiguration requests.
If an immediate upgrade is unavailable, enable stack canaries, MPU protection, or other memory hardening features in the Zephyr build and limit OCPP client communications to trusted central systems only.

Generated by OpenCVE AI on August 25, 2026 at 05:20 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.900% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/zephyrproject-rtos/zephyr/commit/afbf880b04188ae53451a0ade4ac62b654fdff34
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fqhf-6v24-4px2

History

Aug 27, 2026 6:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 25, 2026 5:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Zephyrproject Zephyrproject zephyr
Vendors & Products		Zephyrproject Zephyrproject zephyr

Aug 25, 2026 4:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp_j.c contains a stack buffer overflow in parse_getconfig_msg(). When handling a GetConfiguration request from the central system, the handler copied the attacker-controlled JSON "key" string into the caller's fixed 50-byte stack buffer (skey[CISTR50], declared in subsys/net/lib/ocpp/ocpp.c) using an unbounded strcpy(). The parsed key value points directly into the receive buffer, so its length is bounded only by the message size (CONFIG_OCPP_RECV_BUFFER_SIZE, default 2048). The GetConfiguration message is delivered over the WebSocket connection that the charge point opens to its configured central system. The reader thread ocpp_wsreader() reads the message into ui->recv_buf and dispatches it to parse_getconfig_msg() via the PDU function table. An attacker who controls the central system endpoint, or a man-in-the-middle on an unencrypted connection, can send a GetConfiguration request whose "key" field exceeds 50 bytes and overflow the reader thread's stack with attacker-chosen bytes. The consequence is a remotely triggerable stack smash on the OCPP reader thread: at minimum a denial of service, and plausibly remote code execution depending on build-time hardening such as stack canaries and MPU configuration. The fix replaces the strcpy() with a bounded strncpy(key, payload.key[0], CISTR50 - 1) followed by explicit NUL termination, matching the bounded copies already used by the sibling handlers.
Title		Stack buffer overflow in OCPP GetConfiguration key parsing
Weaknesses		CWE-787
References		https://github.com/zephyrproject-rtos/zephyr/commit/afbf880b04188ae53451a0ade4ac62b654fdff34 https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fqhf-6v24-4px2
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`