CVE-2026-13217

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description The OCPP 1.6 client contains a flaw where it reconstructs a session handle and PDU id from the uid field of a CALLRESULT message. In the ocpp process server msg() function, the code calls atoi(strtok r(uid, "-", &tmp)) without verifying the return value of strtok r(). If the uid provided by the server is empty or lacks a hyphen delimiter, strtok r() returns NULL, leading to a NULL pointer dereference when passed to atoi(). This uid is sourced from network data parsed by parse rpc msg() in subsys/net/lib/ocpp/ocpp j.c via TCP/WebSocket. A compromised central system or a man-in-the-middle attacker on a non-TLS connection can trigger this by sending a malformed uid. On platforms that trap access to address 0, such as those with MMU/MPU or CONFIG NULL POINTER EXCEPTION DETECTION, this results in a remote denial of service of the charge point.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.