CVE-2026-10848

Name of the Vulnerable Software and Affected Versions OCPP 1.6 client (affected versions not specified)

Description The OCPP 1.6 client contains an issue where inbound WAMP RPC frames are parsed using a manual helper function extract string field() within parse rpc msg(). This function uses strncpy() to copy uid and action fields into a 128-byte buffer. Because strncpy() does not ensure NUL-termination when the source string is equal to or longer than the specified length, a subsequent strchr() call can read past the buffer into adjacent stack memory. Additionally, if a quote character is found beyond the buffer, a one-byte out-of-bounds NUL write occurs. A similar issue exists in extract payload(), where strchr() and strrchr() are used on a receive buffer that may not be NUL-terminated. An attacker controlling the central-system server or an on-path attacker can trigger this by sending an RPC frame with a uid or action field exceeding 127 bytes without a closing quote. This can lead to a remote denial of service due to memory faults or stack corruption. This issue affects systems where the experimental CONFIG OCPP feature is enabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, disable the CONFIG OCPP feature if it is not required.