Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-13214— Stack buffer overflow in OCPP GetConfiguration key parsing

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OCPP 1.6 客户端中， 文件中的 函数存在栈缓冲区溢出漏洞。当处理来自中央系统的 （获取配置）请求时，处理程序使用无界拷贝函数 ，将攻击者可控的 JSON “key”（键）字符串拷贝到调用者的固定大小为 50 字节的栈缓冲区 中（该缓冲区定义在 中）。解析后的键值直接指向接收缓冲区，因此其长度仅受消息大小限制（由 定义，默认值为 2048 字节）。 消息通过充电桩（charge point）向其配置的中央系统建立的 WebSocket 连接进行传输。阅读器线程 将消息读入 ，并通过 PDU 函数表将其分派给

CVSS 9.8 · Critical

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-13214

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Stack buffer overflow in OCPP GetConfiguration key parsing
Source: CVE Program / CVE List V5
Vulnerability Description
The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp_j.c contains a stack buffer overflow in parse_getconfig_msg(). When handling a GetConfiguration request from the central system, the handler copied the attacker-controlled JSON "key" string into the caller's fixed 50-byte stack buffer (skey[CISTR50], declared in subsys/net/lib/ocpp/ocpp.c) using an unbounded strcpy(). The parsed key value points directly into the receive buffer, so its length is bounded only by the message size (CONFIG_OCPP_RECV_BUFFER_SIZE, default 2048). The GetConfiguration message is delivered over the WebSocket connection that the charge point opens to its configured central system. The reader thread ocpp_wsreader() reads the message into ui->recv_buf and dispatches it to parse_getconfig_msg() via the PDU function table. An attacker who controls the central system endpoint, or a man-in-the-middle on an unencrypted connection, can send a GetConfiguration request whose "key" field exceeds 50 bytes and overflow the reader thread's stack with attacker-chosen bytes. The consequence is a remotely triggerable stack smash on the OCPP reader thread: at minimum a denial of service, and plausibly remote code execution depending on build-time hardening such as stack canaries and MPU configuration. The fix replaces the strcpy() with a bounded strncpy(key, payload.key[0], CISTR50 - 1) followed by explicit NUL termination, matching the bounded copies already used by the sibling handlers.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 4.3.0 ~ 4.4.2 -

II. Public POCs for CVE-2026-13214

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-13214

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-13214 (1)

Vendor Advisories for CVE-2026-13214 (1)

Same Patch Batch · zephyrproject · 2026-08-25 · 5 CVEs total

CVE-2026-13215 6.8 MEDIUM Zephyr ext2 mount: unvalidated superblock block size causes out-of-bounds write from a cra
CVE-2026-13216 6.1 MEDIUM Out-of-bounds stack write in Zephyr virtio PCI driver from unvalidated device-supplied cap
CVE-2026-13217 5.9 MEDIUM NULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok_r/atoi
CVE-2026-13478 5.5 MEDIUM Out-of-bounds read in Zephyr ext2 block-bitmap validation from a crafted s_blocks_count

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-787

V. Comments for CVE-2026-13214

No comments yet

Leave a comment