External risk intelligence

OCPP Client Stack Buffer Overflow in Zephyr

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-13214

The vulnerability affects an OCPP client within a charge point, which is a device designed to communicate with a central management system over a network. Since these devices frequently connect to external central systems over the internet to operate, the communication channel is a common, internet-reachable service, making the attack surface likely to be exposed in standard deployments.

Out-of-bounds Write

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in the OCPP client software, which is used in some charge point devices. This issue could allow an unauthorized party to disrupt operations or potentially gain control of affected systems. The main concern is confirming relevance and exposure to your environment.

A coding error allows external input to crash systems.
Critical infrastructure could be at risk of disruption.
Assess impact and confirm any exposure.

Attack Path

How an attacker could exploit the issue

An attacker with control over the central management system, or one capable of intercepting communications, can trigger this vulnerability. By sending a specially crafted `GetConfiguration` request over a WebSocket connection, an attacker can exploit a buffer overflow in the charge point's OCPP client. This overflow occurs when processing the "key" field of the request, potentially allowing an attacker to overwrite critical data on the stack, leading to a denial of service or code execution.

Network access to charge point required.
Specially crafted configuration request triggers overflow.
Denial of service or remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A stack buffer overflow in the OCPP client's handling of GetConfiguration requests could allow an attacker controlling the central system to overflow a fixed-size buffer. This occurs when a crafted "key" field in the request exceeds the expected length, potentially leading to a denial of service or remote code execution on the charge point.

Charge point stack memory.
Unbounded string copy from network.
Denial of service or code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides in the OCPP 1.6 client implementation, specifically within charge point devices that communicate with central management systems. Given the network-centric nature of OCPP, the first practical move is to identify all charge points, confirm their external reachability and criticality, and then determine the accountable owner for remediation.

Charge point or IoT platform owners.
Verify external reachability and criticality.
Plan coordinated updates and testing.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the OCPP client in the Zephyr RTOS?

The OCPP client is a software component within Zephyr, an open-source real-time operating system. It enables charge points—such as electric vehicle supply equipment—to communicate with a central management system using the Open Charge Point Protocol (OCPP) version 1.6. This protocol facilitates essential operations like configuration management and status reporting between the physical charging hardware and the backend infrastructure.

How does CVE-2026-13214 create a security risk?

This vulnerability is a stack buffer overflow, classified as CWE-787. It occurs because the software uses an unbounded function to copy data from a network message into a fixed 50-byte memory space on the stack. If a specially crafted request provides a key string longer than that buffer, it overwrites adjacent memory. Depending on the system's security hardening, this can cause the device to crash or potentially allow an attacker to execute unauthorized code.

When does this buffer overflow trigger?

The overflow triggers when the charge point processes a GetConfiguration request over its WebSocket connection. An attacker must send a request where the "key" field exceeds 50 bytes. The vulnerability does not trigger if the "key" field is within the expected size limit. Because the client reads directly from the receive buffer, any message exceeding the fixed buffer's capacity causes the overflow condition.

How do I know if my systems are reachable for this threat?

Halo Surface Signal indicates that this issue is likely exposed in standard deployments because charge points frequently connect to external central systems over the internet. Since the OCPP communication channel is a network-reachable service, any charge point configured to talk to an external or untrusted backend, or one operating over an unencrypted connection susceptible to interception, should be considered accessible to this threat.

What is the first step to address this CVE?

You should begin by creating an inventory of all devices running the affected Zephyr OCPP 1.6 implementation. Once identified, evaluate which charge points are reachable over the internet or critical to your operations. Contact your device manufacturers or platform providers to confirm if they use this version of the Zephyr OCPP library and obtain the necessary updates to apply the required buffer length checks.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.