Executive brief
Open Vehicle Monitoring System 3 (OVMS3) is an open-source hardware and software platform used to monitor and control electric vehicles. A security vulnerability in its log parsing component allows an attacker to send specially crafted data frames that can crash the system or potentially allow unauthorized code execution. This could lead to a loss of vehicle monitoring capabilities or a complete system takeover.
Technical details
A stack-based buffer overflow exists in the 'canformat_canswitch.cpp' component of OVMS3 version 3.3.005. The vulnerability is caused by a failure to properly validate the Data Length Code (DLC) value within CANswitch frames before performing a memory copy (memcpy) into a fixed-size stack buffer. An attacker can exploit this by providing a malformed CANswitch log file or frame with an oversized DLC value. This can result in memory corruption, leading to a denial of service (system crash) or potential remote code execution. The attack can be carried out over the network without requiring authentication.
Affected products
- Open Vehicles Open Vehicle Monitoring System 3 (OVMS3) 3.3.005
Timeline
- 2026-04-30: disclosed: Initial disclosure by Innora Security Research
- 2026-05-01: advisory: CVE published and CVSS assigned by CISA-ADP
- 2026-05-06: other: Issue tracked by maintainers on GitHub