CVE-2026-13214

Name of the Vulnerable Software and Affected Versions OCPP 1.6 client (affected versions not specified)

Description A stack buffer overflow exists in the parse getconfig msg() function within the subsys/net/lib/ocpp/ocpp j.c file. The issue occurs when the handler processes a GetConfiguration request from a central system and uses an unbounded strcpy() to copy an attacker-controlled JSON key string into a fixed 50-byte stack buffer skey[CISTR50] located in subsys/net/lib/ocpp/ocpp.c. Because the key value length is only limited by the receive buffer size (CONFIG OCPP RECV BUFFER SIZE), an attacker controlling the central system endpoint or performing a man-in-the-middle attack on an unencrypted connection can send a request with a key field exceeding 50 bytes. This can lead to a stack smash on the ocpp wsreader() reader thread, resulting in a denial of service or potentially remote code execution.

Recommendations Replace the strcpy() function with a bounded strncpy(key, payload.key[0], CISTR50 - 1) and ensure explicit NUL termination.