The vulnerability resides in the Zephyr OCPP 1.6 client, where an unvalidated call to strtok_r followed by atoi dereferences a NULL pointer if the server‑supplied uid is malformed. The defect is partially repaired in commit 4d8a9eb by guarding the first atoi, but the subsequent strtok_r(NULL, "-", &tmp) followed by pdu = atoi(buf) remains unchecked, so a uid containing a first token but no second token still triggers a NULL dereference. The resulting undefined behaviour causes a fault in the OCPP reader thread, leading to a system crash on platforms that trap accesses to address zero. The impact is limited to availability, producing a remote denial of service on affected Zephyr targets and is platform conditional.

All Zephyr RTOS builds that include the OCPP 1.6 client prior to the application of the fix in commit 4d8a9eb1448061ccee557ef20a2a58aec91d9cad. The vulnerability affects any device that uses the default OCPP client module without a patched source, regardless of the specific version number, because no version information is provided in the advisory.

The CVSS score of 5.9 indicates a moderate severity and the EPSS score is not available. The defect is not listed in CISA’s KEV catalog. An attacker can trigger the fault by sending a malformed uid string over an untrusted or man‑in‑the‑middle WebSocket connection to the charge point, without requiring authentication. The exploit requires only network access to the OCPP server, making the risk base attack vector network. While the vulnerability exploited is a null‑pointer dereference (CWE‑476), the lack of strong input validation makes it relatively easy to deliver a malformed uid. The exploit does not provide arbitrary code execution; it merely causes a denial of service on platforms that fault on null dereference. The defect can also be triggered by a uid that contains a first token but no second token after the delimiter, owing to the second strtok_r call being unchecked.