Stack Buffer Overflow in OCPP 1.6 Client Affects Zephyr Project

CVE-2026-13214

What is CVE-2026-13214?

The OCPP 1.6 client within the Zephyr Project software has a stack buffer overflow vulnerability in the parse_getconfig_msg() function. When it processes a GetConfiguration request, an attacker can exploit this by sending a JSON 'key' string longer than the designated 50-byte buffer, leading to a potential stack smash. This could result in a denial of service and, depending on system configurations such as stack canaries, may enable remote code execution. The vulnerability arises from the usage of unbounded strcpy(), which is vulnerable to overflow attacks if the input exceeds expected limits. The recommended fix implements a safer bounded string copy method, ensuring proper limits and security practices in handling incoming data.

References