CVE-2026-13217
Received Received - Intake

NULL Pointer Dereference in Zephyr RTOS OCPP 1.6 Client

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: Zephyr Project

Description
The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLRESULT message. In ocpp_process_server_msg() the code calls atoi(strtok_r(uid, "-", &tmp)) without checking the strtok_r return value. When the server-supplied uid is empty or contains no - delimiter, strtok_r() returns NULL and atoi(NULL) dereferences a NULL pointer, which is undefined behaviour. The uid originates from network data: parse_rpc_msg() in subsys/net/lib/ocpp/ocpp_j.c JSON-parses a frame received from the OCPP central system over TCP/WebSocket and copies the server-controlled string into the local buffer. A malicious or compromised central system, or a man-in-the-middle on a non-TLS ws:// connection, can return a malformed uid to reach the defect. No authentication beyond the existing server connection (or MITM position) is required, and the reconstructed pointer is membership-validated by ocpp_session_is_valid(), so the impact is limited to the NULL dereference rather than arbitrary pointer use. On Zephyr targets that trap access to address 0 (MMU/MPU platforms or CONFIG_NULL_POINTER_EXCEPTION_DETECTION), the dereference faults inside the OCPP reader thread and invokes the fatal handler, producing a remote denial of service of the charge point; on bare targets where address 0 is readable the call returns 0 and is benign, so the impact is availability-only and platform-conditional. The applied fix guards only the first atoi(); the second strtok_r(NULL, "-", &tmp) followed by pdu = atoi(buf) in the same function remains unguarded and the identical NULL dereference is still reachable from the same network input when the uid has a first token but no second --delimited token. A complete fix should validate the second token as well.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-13217
EUVD
EUVD-2026-65598

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
zephyrproject zephyr 4.3.0
zephyrproject zephyr 4.4.1
zephyrproject zephyr 4.4.2
zephyrproject ocpp 1.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a NULL-pointer dereference in the Zephyr RTOS OCPP 1.6 client. It occurs when parsing a CALLRESULT message's uid field. The code calls atoi(strtok_r(uid, "-", &tmp)) without checking if strtok_r returns NULL. If the uid is empty or lacks a "-" delimiter, strtok_r returns NULL, causing atoi(NULL) to dereference a NULL pointer, leading to undefined behavior.

Detection Guidance

To detect this vulnerability, monitor OCPP 1.6 client logs for crashes or NULL pointer exceptions in the OCPP reader thread. Check Zephyr RTOS systems running vulnerable versions (v4.3.0 to v4.4.1) for malformed CALLRESULT messages with empty or improperly formatted uid fields. Use network traffic analysis tools like Wireshark to inspect OCPP TCP/WebSocket traffic for malformed uid values.

Impact Analysis

The impact depends on the platform. On MMU/MPU systems, it can cause a denial-of-service by triggering a fault when address 0 is accessed. On bare-metal systems, it may be benign as address 0 is readable. The vulnerability can be exploited remotely by a malicious central system or man-in-the-middle attacker on an unencrypted connection.

Compliance Impact

This vulnerability primarily impacts availability by causing remote denial-of-service conditions on affected systems. It does not directly compromise data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, prolonged downtime could indirectly affect compliance by disrupting operations that handle personal or health data.

Mitigation Strategies

Upgrade to Zephyr RTOS v4.4.2 or later, which includes patches for this issue. If upgrading is not immediately possible, ensure OCPP connections use TLS (wss://) to prevent man-in-the-middle attacks. Validate all uid fields in CALLRESULT messages before processing. Apply the incomplete fix by adding NULL checks for both strtok_r calls in ocpp_process_server_msg().

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13217. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart