The vulnerability exists in Zephyr's OCPP 1.6 client within the parse_rpc_msg() function, which uses a custom helper extract_string_field() that copies uid and action fields using strncpy without guaranteed null-termination. When these fields are 127 or more bytes without a closing quote, strchr scans beyond the 128-byte buffer into adjacent stack memory, causing an out-of-bounds read and a one-byte out-of-bounds null write. A related issue in extract_payload() also scans buffers that may not be null-terminated. The data comes from the OCPP central-system server over a websocket, which can be exploited remotely if the server is malicious or compromised, or by an on-path attacker since OCPP often uses unencrypted ws://. The primary impact is a remotely triggerable denial of service due to potential faults on unmapped memory and stack corruption. The vulnerability affects versions 4.3.0 through before 4.5.0. The fix involves replacing the manual parser with json_mixed_arr_parse() and ensuring explicit null-termination of buffers.

A remote attacker controlling or intercepting the OCPP central-system server connection can send specially crafted RPC frames with oversized uid or action fields to trigger out-of-bounds memory reads and writes in the client. This can cause a denial of service by crashing the client due to memory faults or stack corruption. Confidentiality impact is limited as the over-read data is not sent back to the attacker. The vulnerability affects an experimental feature that must be enabled explicitly, reducing exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has fixed the issue by replacing the manual parser with a bounds-respecting JSON parser and ensuring explicit null-termination of buffers. Users should upgrade to versions including this fix when available or apply the vendor's official patch once released. Until then, consider disabling the experimental OCPP feature (CONFIG_OCPP) if not required to reduce risk.