Executive brief
The Open Vehicle Monitoring System (OVMS3) is a hardware and software platform used to remotely monitor and control electric vehicles. A security flaw in how the system processes vehicle data logs allows an attacker to send specially crafted data that can crash the device or potentially allow them to take control of it. This could lead to a loss of vehicle monitoring capabilities or unauthorized access to vehicle data.
Technical details
A stack-based buffer overflow exists in the GVRET log format parser within 'canformat_gvret.cpp' of OVMS3 version 3.3.005. The vulnerability is caused by a lack of validation on the length field within GVRET binary data frames before it is used as a size argument in a 'memcpy' operation into a fixed-size stack buffer. An attacker can exploit this by providing a malformed GVRET frame, potentially leading to remote code execution (RCE) or a denial of service (DoS). While the CVSS score is high, the attack requires the system to process a malicious log file or frame, which may be delivered over the network depending on the device configuration.
Affected products
- Open Vehicles Open Vehicle Monitoring System 3 (OVMS3) 3.3.005
Timeline
- 2026-04-30: disclosed: Initial disclosure by Innora Security Research
- 2026-05-01: advisory: CVE published in NVD
- 2026-05-06: other: Issue tracked by maintainers in GitHub repository