Executive brief
Zephyr RTOS contains a stack buffer overflow in its OCPP 1.6 (charging protocol) client implementation. An attacker controlling or intercepting communication between a charge point and its central system can send a malicious message that crashes the device or potentially executes arbitrary code on the RTOS kernel, affecting EV charging infrastructure availability and security.
Technical details
The vulnerability is a classic stack buffer overflow (CWE-674) in parse_getconfig_msg() within subsys/net/lib/ocpp/ocpp_j.c. The handler uses unbounded strcpy() to copy a JSON "key" field from an OCPP GetConfiguration message into a fixed 50-byte stack buffer (skey[CISTR50]). The attacker-controlled key value is bounded only by the WebSocket receive buffer size (default 2048 bytes), allowing overflow. The message is delivered over a WebSocket connection initiated by the charge point to a configured central system; an attacker who controls that endpoint or performs MITM on unencrypted connections can trigger the overflow. The impact ranges from denial of service (reader thread crash) to remote code execution depending on stack protections (canaries, MPU). The fix replaces strcpy() with bounded strncpy(key, payload.key[0], CISTR50 - 1) followed by explicit NUL termination.
Affected products
- Zephyr Project Zephyr RTOS <UNKNOWN>
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fix committed as afbf880b04188ae53451a0ade4ac62b654fdff34