The vulnerability resides in the Zephyr OCPP 1.6 client, where an unvalidated call to strtok_r followed by atoi dereferences a NULL pointer if the server‑supplied uid is malformed. The resulting undefined behaviour causes a fault in the OCPP reader thread, leading to a system crash on platforms that trap accesses to address zero. The impact is limited to availability, producing a remote denial of service on affected Zephyr targets.

All Zephyr RTOS builds that include the OCPP 1.6 client prior to the application of the fix in commit 4d8a9eb1448061ccee557ef20a2a58aec91d9cad. The vulnerability affects any device that uses the default OCPP client module without a patched source, regardless of the specific version number, because no version information is provided in the advisory.

The CVSS score of 5.9 indicates a moderate severity, and the EPSS score is not available. The defect is not listed in CISA’s KEV catalog. An attacker can trigger the fault by sending a malicious uid string over an untrusted or man‑in‑the‑middle WebSocket connection to the charge point, without requiring authentication. The exploit requires only network access to the OCPP server, making the risk base attack vector network. While the vulnerability exploited is a null‑pointer dereference (CWE‑476), the lack of strong input validation makes it relatively easy to deliver a malformed uid. The exploit does not provide arbitrary code execution; it merely causes a denial of service on platforms that fault on null dereference.