The vulnerability in Zephyr's OCPP 1.6 client arises from an unbounded strcpy() call in parse_getconfig_msg() that copies the 'key' field from a GetConfiguration JSON request into a fixed-size 50-byte stack buffer. Since the key string length is only bounded by the receive buffer size (default 2048 bytes), an attacker controlling the central system or intercepting the WebSocket connection can send an oversized key, triggering a stack buffer overflow on the reader thread. This can lead to denial of service or remote code execution depending on build-time mitigations such as stack canaries and MPU configuration. The fix involves replacing strcpy() with a bounded strncpy() and explicit null termination.

This vulnerability allows remote attackers who control the central system endpoint or can perform man-in-the-middle attacks on unencrypted WebSocket connections to cause a stack buffer overflow in the OCPP reader thread. The impact ranges from denial of service due to a stack smash to potential remote code execution depending on the device's security hardening. The CVSS score of 9.8 reflects the critical nature of this remote, unauthenticated, network-based vulnerability with high confidentiality, integrity, and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix replaces the unsafe strcpy() with a bounded strncpy() and explicit null termination to prevent overflow. Until an official patch is available, avoid exposing the OCPP WebSocket connection to untrusted or man-in-the-middle capable networks, and consider applying build-time hardening such as stack canaries and MPU configuration to mitigate exploitation impact.