CVE-2026-13217 in Zephyr
Summary
by MITRE • 08/25/2026
The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLRESULT message. In ocpp_process_server_msg() the code calls atoi(strtok_r(uid, "-", &tmp)) without checking the strtok_r return value. When the server-supplied uid is empty or contains no - delimiter, strtok_r() returns NULL and atoi(NULL) dereferences a NULL pointer, which is undefined behaviour.
The uid originates from network data: parse_rpc_msg() in subsys/net/lib/ocpp/ocpp_j.c JSON-parses a frame received from the OCPP central system over TCP/WebSocket and copies the server-controlled string into the local buffer. A malicious or compromised central system, or a man-in-the-middle on a non-TLS ws:// connection, can return a malformed uid to reach the defect. No authentication beyond the existing server connection (or MITM position) is required, and the reconstructed pointer is membership-validated by ocpp_session_is_valid(), so the impact is limited to the NULL dereference rather than arbitrary pointer use.
On Zephyr targets that trap access to address 0 (MMU/MPU platforms or CONFIG_NULL_POINTER_EXCEPTION_DETECTION), the dereference faults inside the OCPP reader thread and invokes the fatal handler, producing a remote denial of service of the charge point; on bare targets where address 0 is readable the call returns 0 and is benign, so the impact is availability-only and platform-conditional.
The applied fix guards only the first atoi(); the second strtok_r(NULL, "-", &tmp) followed by pdu = atoi(buf) in the same function remains unguarded and the identical NULL dereference is still reachable from the same network input when the uid has a first token but no second --delimited token. A complete fix should validate the second token as well.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability described involves a critical null pointer dereception within the Open Charge Point Protocol (OCPP) 1.6 client implementation in the Zephyr operating system, specifically located in the subsys/net/lib/ocpp/ocpp.c module. This flaw arises during the processing of server messages where the application attempts to reconstruct session handles and protocol data unit identifiers from a user-provided identifier field within CALLRESULT messages. The core technical defect lies in the improper handling of string tokenization functions, specifically strtok_r, which is called without verifying its return value before passing it to atoi for conversion into an integer. When the server-supplied uid field is empty or lacks the expected hyphen delimiter that separates tokens, strtok_r returns a null pointer instead of a valid string reference. Passing this null pointer directly to atoi results in undefined behavior because the function attempts to dereference memory address zero to read data that does not exist.
The attack vector for this vulnerability originates from network traffic received by the charge point via TCP or WebSocket connections to an OCPP central system. The process begins when parse_rpc_msg in ocpp_j.c JSON-parses incoming frames and copies server-controlled strings into local buffers. A malicious actor, such as a compromised central system operator or a man-in-the-middle attacker exploiting non-TLS ws:// connections, can inject malformed uid values designed to trigger this code path. The vulnerability does not require additional authentication beyond the existing connection state, making it accessible to any entity capable of communicating with the charge point over the network interface. While the reconstructed pointer is subsequently validated by ocpp_session_is_valid(), which limits the impact to a null dereference rather than arbitrary memory write or execution, this validation occurs after the crash has already been triggered on vulnerable platforms.
The operational impact of this vulnerability is primarily focused on availability and system stability, with severity dependent on the underlying hardware architecture and configuration settings of the Zephyr target platform. On systems equipped with Memory Management Units or Memory Protection Units that trap access to address zero, such as those enabled by CONFIG_NULL_POINTER_EXCEPTION_DETECTION, the null dereference causes a fatal exception within the OCPP reader thread. This triggers the system's fatal error handler, resulting in an immediate crash of the charge point software and effectively causing a remote denial of service condition where the device becomes unresponsive to charging commands or status updates. On bare-metal targets without such protection mechanisms, address zero may be readable, allowing atoi to return zero benignly; however, this behavior is inconsistent across platforms and should not be relied upon for security guarantees.
From a classification perspective, this vulnerability aligns with CWE-476, which denotes NULL Pointer Dereference, as the application fails to check for null returns from library functions before using them in subsequent operations. It also relates to CWE-20, Improper Input Validation, because the system does not adequately validate the structure and content of network-supplied data prior to processing. In terms of adversarial tactics, this exploit corresponds to ATT&CK technique T1498, Network Denial of Service, specifically through resource exhaustion or service disruption via malformed input that causes application crashes rather than simple bandwidth saturation. The vulnerability highlights a common pattern in embedded systems development where assumptions about data format integrity are not enforced at the parsing layer.
Although a patch has been applied to guard the first atoi call against null pointers from strtok_r, the remediation is incomplete and leaves the system vulnerable to similar exploitation vectors within the same function. Specifically, the code continues with a second invocation of strtok_r using NULL as the string argument followed by another atoi call on the resulting buffer without checking for null returns. If an attacker provides a uid that contains one hyphen but no subsequent token, the first strtok_r succeeds while the second fails silently by returning NULL, leading to the same null pointer dereference when passed to atoi. This oversight means that attackers can still trigger crashes or undefined behavior on vulnerable platforms using slightly modified input strings. A complete fix requires rigorous validation of all tokens derived from network inputs and consistent error handling for every instance where string parsing functions are employed in critical security paths.