Critical OCPP Stack Buffer Overflow in EV Charging RTOS Clients

Executive Summary

CVE-2026-13214 is a critical stack buffer overflow (CVSS 9.8) discovered in the OCPP 1.6 (Open Charge Point Protocol) client implementation found in embedded RTOS networking subsystems. The vulnerability exists in parse_getconfig_msg() within subsys/net/lib/ocpp/ocpp_j.c, where an attacker-controlled JSON "key" string from a malicious central charging station is copied without bounds checking into a fixed 50-byte stack buffer (skey[CISTR50]).

Because OCPP's central system acts as the controlling authority for charge point clients — and the overflow requires no authentication — a compromised or rogue central system can execute arbitrary code on every connected charge point.

Vulnerability Details

Root Cause

OCPP 1.6 uses a JSON-over-WebSocket protocol where the central system sends GetConfiguration requests to charge points to retrieve configuration keys. The vulnerable handler reads the "key" array element from the incoming JSON and copies it into a caller-supplied buffer declared as:

char skey[CISTR50];  /* 50-byte fixed stack buffer */

The copy operation does not validate the length of the attacker-supplied string before writing it into skey. An attacker who controls or compromises the central system — or who can man-in-the-middle the WebSocket connection — can send a GetConfiguration message with a "key" value exceeding 50 bytes, overflowing the buffer and overwriting adjacent stack data including the saved return address.

Attack Scenario

Central System (attacker-controlled)
    │
    │  GetConfiguration { "key": "A" * 500 }   ← oversized key
    │
    ▼
Charge Point OCPP Client
    └─ parse_getconfig_msg() called
       └─ strcpy(skey, json_key)  ← no length check
          └─ 500 bytes → 50-byte buffer
             └─ Stack smash → RCE

Because the central system is the trusted authority in OCPP architecture, charge points accept messages without additional authentication. A rogue or compromised central system operator can target the entire fleet of connected charge points simultaneously.

Affected Systems

The vulnerability is present in the OCPP 1.6 client implementation within the embedded networking subsystem at subsys/net/lib/ocpp/ocpp_j.c. Systems affected include:

• Zephyr RTOS — OCPP 1.6 networking stack (prior to patch)
• Any downstream firmware or product integrating this OCPP 1.6 client code without the bounds-checking fix
• EV charge point hardware running RTOS builds that include this subsystem

Impact

Successful exploitation of CVE-2026-13214 allows an attacker to:

1. Execute arbitrary code on the charge point's main processor
2. Disable or brick charging stations (denial of service to EV infrastructure)
3. Pivot into local networks — many commercial charge points are connected to enterprise or building networks
4. Modify billing logic — enabling free charging or fraudulent transactions
5. Install persistent firmware implants — surviving reboots if flash write capabilities exist

Why This Is High Risk

EV charging infrastructure is increasingly integrated into enterprise campuses, parking structures, and grid-connected energy management systems. A compromised charge point with network access can:

• Exfiltrate network credentials observed in transit
• Serve as a pivot point for lateral movement into corporate or industrial networks
• Participate in coordinated grid-load attacks if multiple charge points are controlled simultaneously

Remediation

Immediate Actions

1. Apply the upstream patch — The fix validates the JSON key length against CISTR50 before copying. Upgrade to any build that includes the bounds-checking fix in parse_getconfig_msg().

2. Restrict central system access — Ensure charge points only connect to trusted, authenticated central system endpoints. Enforce TLS with certificate pinning where possible.

3. Network segmentation — Place EV charging networks on isolated VLANs with no direct access to corporate infrastructure.

4. Monitor WebSocket traffic — Alert on GetConfiguration messages with key values exceeding 50 characters from unexpected sources.

Fix Overview

The correct implementation validates input length before the copy:

/* Patched version */
if (strlen(json_key) >= sizeof(skey)) {
    return -EINVAL;  /* reject oversized key */
}
strncpy(skey, json_key, sizeof(skey) - 1);
skey[sizeof(skey) - 1] = '\0';

Detection

Indicators of Exploitation Attempt

Network Monitoring

Monitor the WebSocket connection to the OCPP central system for malformed GetConfiguration payloads. Legitimate OCPP key names are well-defined in the specification and do not approach 50 characters.

Key Takeaways

1. CVSS 9.8 Critical — Unauthenticated stack buffer overflow via attacker-controlled JSON input
2. No authentication required — Central system trust model means any rogue/compromised central system can attack the entire charge point fleet
3. Patch immediately — Apply the upstream bounds-checking fix; rebuild and redeploy affected firmware
4. Segment EV networks — Charge points should not have direct access to enterprise systems
5. EV infrastructure is OT — Apply operational technology (OT) security principles: assume compromise, monitor deeply, isolate aggressively

References

• NVD — CVE-2026-13214
• Zephyr Project Security Advisories
• OCPP 1.6 Specification — Open Charge Alliance

Related Reading

• Critical BeyondTrust RCE Under Active Exploitation
• Apache Struts OGNL RCE CVE-2026-3098