CVE-2026-13214
CriticalCVSS 9.8Summary
The OCPP 1.6 client contains a stack buffer overflow in parse_getconfig_msg(). An attacker controlling the central system or performing a man-in-the-middle attack can send a GetConfiguration request with a key longer than 50 bytes, causing a stack overflow in the reader thread.
Risk Assessment
This can lead to remote code execution or denial of service in the EV charging system, potentially disrupting charging infrastructure.
Recommendation
Apply the patch that replaces the unsafe strcpy() with strncpy() and explicit NUL termination. Update the software to a patched version.
Original NVD description (English source)
The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp_j.c contains a stack buffer overflow in parse_getconfig_msg(). When handling a GetConfiguration request from the central system, the handler copied the attacker-controlled JSON "key" string into the caller's fixed 50-byte stack buffer (skey[CISTR50], declared in subsys/net/lib/ocpp/ocpp.c) using an unbounded strcpy(). The parsed key value points directly into the receive buffer, so its length is bounded only by the message size (CONFIG_OCPP_RECV_BUFFER_SIZE, default 2048). The GetConfiguration message is delivered over the WebSocket connection that the charge point opens to its configured central system. The reader thread ocpp_wsreader() reads the message into ui->recv_buf and dispatches it to parse_getconfig_msg() via the PDU function table. An attacker who controls the central system endpoint, or a man-in-the-middle on an unencrypted connection, can send a GetConfiguration request whose "key" field exceeds 50 bytes and overflow the reader thread's stack with attacker-chosen bytes. The consequence is a remotely triggerable stack smash on the OCPP reader thread: at minimum a denial of service, and plausibly remote code execution depending on build-time hardening such as stack canaries and MPU configuration. The fix replaces the strcpy() with a bounded strncpy(key, payload.key[0], CISTR50 - 1) followed by explicit NUL termination, matching the bounded copies already used by the sibling handlers.