CVE-2026-13214
Received Received - Intake

Stack Buffer Overflow in OCPP 1.6 Client

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: Zephyr Project

Description
The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp_j.c contains a stack buffer overflow in parse_getconfig_msg(). When handling a GetConfiguration request from the central system, the handler copied the attacker-controlled JSON "key" string into the caller's fixed 50-byte stack buffer (skey[CISTR50], declared in subsys/net/lib/ocpp/ocpp.c) using an unbounded strcpy(). The parsed key value points directly into the receive buffer, so its length is bounded only by the message size (CONFIG_OCPP_RECV_BUFFER_SIZE, default 2048). The GetConfiguration message is delivered over the WebSocket connection that the charge point opens to its configured central system. The reader thread ocpp_wsreader() reads the message into ui->recv_buf and dispatches it to parse_getconfig_msg() via the PDU function table. An attacker who controls the central system endpoint, or a man-in-the-middle on an unencrypted connection, can send a GetConfiguration request whose "key" field exceeds 50 bytes and overflow the reader thread's stack with attacker-chosen bytes. The consequence is a remotely triggerable stack smash on the OCPP reader thread: at minimum a denial of service, and plausibly remote code execution depending on build-time hardening such as stack canaries and MPU configuration. The fix replaces the strcpy() with a bounded strncpy(key, payload.key[0], CISTR50 - 1) followed by explicit NUL termination, matching the bounded copies already used by the sibling handlers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-13214
EUVD
EUVD-2026-65291

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
zephyrproject zephyr 4.3.0
zephyrproject zephyr 4.4.1
zephyrproject zephyr From 4.4.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack-based buffer overflow in the OCPP 1.6 client of Zephyr RTOS. It occurs in the parse_getconfig_msg() function where an attacker-controlled JSON 'key' string is copied into a fixed 50-byte stack buffer using an unsafe strcpy() function. The attacker can send a GetConfiguration request with a 'key' field exceeding 50 bytes, causing stack memory corruption in the OCPP WebSocket reader thread.

The issue allows remote code execution or denial of service depending on system hardening. The vulnerability is triggered when a Zephyr device with OCPP enabled connects to a malicious central system or a man-in-the-middle on an unencrypted connection.

Detection Guidance

To detect this vulnerability, inspect OCPP traffic for GetConfiguration requests with key fields exceeding 50 bytes. Monitor for crashes or stack corruption in OCPP reader threads. Check Zephyr RTOS versions between 4.3.0 and 4.4.1 for affected systems.

Impact Analysis

This vulnerability can lead to denial of service, causing the affected device to crash or reboot. In non-hardened builds, it may allow remote code execution, enabling an attacker to take control of the device. The impact depends on the system's stack protection mechanisms like stack canaries or MPU configuration.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized remote code execution or denial of service on systems handling sensitive data. A successful exploit may allow attackers to access or disrupt systems managing personal health information (HIPAA) or user data (GDPR), potentially violating confidentiality and integrity requirements.

Mitigation Strategies

Upgrade Zephyr RTOS to version 4.4.2 or later. Disable OCPP if not needed. Ensure WebSocket connections to central systems are encrypted. Monitor for suspicious OCPP traffic patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13214. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart