Improper Handling of Session Handles in OCPP Client by Zephyr

CVE-2026-13217

What is CVE-2026-13217?

The OCPP 1.6 client in the Zephyr project is susceptible to a vulnerability where it improperly handles session handles and PDU IDs derived from a CALLRESULT message. The flaw arises in ocpp_process_server_msg(), where the code attempts to parse an incoming uid from the server without validating its content. If the uid is empty or lacks the necessary delimiter, the code attempts to convert it to an integer, leading to undefined behavior due to NULL pointer dereferencing. This situation can be exploited by a malicious or compromised OCPP central system, or through a man-in-the-middle attack, resulting in a denial of service condition. Affected systems could experience a fault within the OCPP reading thread, potentially halting service. While the applied fix addresses part of the issue, further validation is required for all tokens to prevent similar attacks.

References