CVE-2026-13214: memory-safety in zephyrproject zephyr

The vulnerability exists in the Zephyr OCPP 1.6 client code, specifically in subsys/net/lib/ocpp/ocpp_j.c's parse_getconfig_msg() function. It improperly uses an unbounded strcpy() to copy the 'key' string from a GetConfiguration request into a fixed-size 50-byte stack buffer (skey[CISTR50]). Since the key length is only limited by the receive buffer size (default 2048 bytes), this can overflow the stack of the OCPP reader thread. The attack vector is via the WebSocket connection from the central system to the charge point. The vulnerability can lead to a stack smash, causing denial of service or potentially remote code execution depending on build-time mitigations like stack canaries and MPU configuration. The fix involves replacing strcpy() with a bounded strncpy() and explicit null termination.

This vulnerability allows a remote attacker who controls the central system endpoint or can intercept unencrypted WebSocket traffic to trigger a stack buffer overflow in the OCPP reader thread. The immediate impact is denial of service due to stack corruption. Depending on the device's build-time security hardening, it may also enable remote code execution, posing a severe risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix replaces the unsafe strcpy() with a bounded strncpy() and explicit null termination. Until an official patch is available, avoid connecting to untrusted central systems and ensure WebSocket connections are encrypted to prevent man-in-the-middle attacks.