Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-13217— NULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok_r/atoi

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述信息的中文翻译： 在 中，OCPP 1.6 客户端会从 消息的 字段重构会话句柄（session handle）和 PDU 标识符（PDU id）。在 函数中，代码调用了 ，但未检查 的返回值。当服务器提供的 为空或不包含 分隔符时， 返回 NULL，而 会解引用空指针，导致未定义行为。 该 源自网络数据：在 中， 函数会对通过 TCP/WebSocket 从 OCPP 中央系统接收到的帧进行 JSON 解析，并将由服务器控制的字符串复制到本地缓冲区。恶意或已被攻陷的中央系统，或者在非 TLS 协议

CVSS 5.9 · Medium

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 1

VendorProduct Version RangeStatus
zephyrproject zephyr 4.3.0< 4.4.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-13217

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
NULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok_r/atoi
Source: CVE Program / CVE List V5
Vulnerability Description
The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLRESULT message. In ocpp_process_server_msg() the code calls atoi(strtok_r(uid, "-", &tmp)) without checking the strtok_r return value. When the server-supplied uid is empty or contains no - delimiter, strtok_r() returns NULL and atoi(NULL) dereferences a NULL pointer, which is undefined behaviour. The uid originates from network data: parse_rpc_msg() in subsys/net/lib/ocpp/ocpp_j.c JSON-parses a frame received from the OCPP central system over TCP/WebSocket and copies the server-controlled string into the local buffer. A malicious or compromised central system, or a man-in-the-middle on a non-TLS ws:// connection, can return a malformed uid to reach the defect. No authentication beyond the existing server connection (or MITM position) is required, and the reconstructed pointer is membership-validated by ocpp_session_is_valid(), so the impact is limited to the NULL dereference rather than arbitrary pointer use. On Zephyr targets that trap access to address 0 (MMU/MPU platforms or CONFIG_NULL_POINTER_EXCEPTION_DETECTION), the dereference faults inside the OCPP reader thread and invokes the fatal handler, producing a remote denial of service of the charge point; on bare targets where address 0 is readable the call returns 0 and is benign, so the impact is availability-only and platform-conditional. The applied fix guards only the first atoi(); the second strtok_r(NULL, "-", &tmp) followed by pdu = atoi(buf) in the same function remains unguarded and the identical NULL dereference is still reachable from the same network input when the uid has a first token but no second --delimited token. A complete fix should validate the second token as well.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 4.3.0 ~ 4.4.2 -

II. Public POCs for CVE-2026-13217

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-13217

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-13217 (2)

Vendor Advisories for CVE-2026-13217 (1)

Same Patch Batch · zephyrproject · 2026-08-25 · 5 CVEs total

CVE-2026-13214 9.8 CRITICAL Stack buffer overflow in OCPP GetConfiguration key parsing
CVE-2026-13215 6.8 MEDIUM Zephyr ext2 mount: unvalidated superblock block size causes out-of-bounds write from a cra
CVE-2026-13216 6.1 MEDIUM Out-of-bounds stack write in Zephyr virtio PCI driver from unvalidated device-supplied cap
CVE-2026-13478 5.5 MEDIUM Out-of-bounds read in Zephyr ext2 block-bitmap validation from a crafted s_blocks_count

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-476

V. Comments for CVE-2026-13217

No comments yet

Leave a comment