Zephyr Project OCPP Client Stack Buffer Overflow CVE-2026-13214

A stack-based buffer overflow exists in the Zephyr Project RTOS OCPP client’s parse_getconfig_msg function (ocpp_j.c) affecting versions ≤4.4.1. The flaw occurs when processing a malformed Open Charge Point Protocol GetConfiguration message from a Charge Point Management System, allowing an unauthenticated remote attacker to overwrite the stack with an excessively long key parameter. Successful exploitation can trigger a denial‑of‑service or achieve remote code execution on resource‑constrained EV charging stations lacking robust memory protection. Immediate patching or mitigating network exposure is required to prevent compromise of EVSE infrastructure.

• Vulnerability Overview
• Affected component: Zephyr Project OCPP client library (ocpp_j.c), function parse_getconfig_msg.
• Root cause: Missing bounds check on the key field extracted from a JSON‑encoded GetConfiguration request.
• Affected versions: Zephyr RTOS releases up to and including v4.4.1.

• Patch reference: Commit a3f9c2e (Zephyr Project) adds strnlen validation before copying the key into a fixed‑size stack buffer.

• Technical Deep Dive

• The vulnerable buffer is a 64‑byte array on the stack; attacker‑supplied key >64 bytes overflows into saved return address and callee‑saved registers.
• On ARM Cortex‑M targets (common in EVSE), MPU may be disabled or not configured to guard the stack, enabling direct control of execution flow.
• Exploitation payload: OCPP GetConfiguration JSON with "key": "A"*200 (or larger) to overwrite return address with attacker‑chosen gadget address for RCE or NOP sled for DoS.

• No authentication is required on the OCPP channel; the CPMS is trusted by design, making the attack vector purely network‑based.

• Impact & Exploitation Status

• Potential outcomes: system crash (DoS), firmware corruption, or full device takeover enabling manipulation of charging operations, firmware injection, or lateral movement to grid‑management systems.
• Industry vertical: Electric Vehicle Charging Infrastructure / Smart Grid.
• CVSS v3.1 vector (estimated): AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H → Base score 9.8 (Critical).

• As of CVE publication, no public exploits observed, but the vulnerability is trivially reproducible in lab environments.

• Detection & Mitigation

• Network IDS/IPS signatures: inspect OCPP GetConfiguration messages for key length >64 bytes (e.g., Snort rule content:"|22 6b 65 79 22|"; distance:0; within:5; byte_test:2,>,64,0,relative;).
• Enable stack canaries and MPU regions in Zephyr builds (CONFIG_STACK_CANARIES=y, CONFIG_MPU=y) to increase exploit difficulty.
• Apply the Zephyr patch immediately or upgrade to Zephyr v4.4.2+ where the fix is backported.

• Restrict OCPP interface to trusted CPMS IP ranges via firewall rules as an interim measure.

• Conclusion

• CVE-2026-13214 highlights the risk of insufficient input validation in RTOS‑based IoT protocols where memory protections are often minimal.
• Prompt application of the upstream patch, combined with hardening of stack protections and network segmentation, mitigates the threat.
• Organizations deploying Zephyr‑based EVSE should audit OCPP message handling and validate that all external inputs are length‑checked before use.