Zephyr RTOS CVE-2026-13214

Exploitation requires that the target device runs Zephyr's OCPP 1.6 client and has an active WebSocket session to a central system, and that the attacker occupies the central-system position - either by controlling/compromising the configured central system endpoint, or by man-in-the-middling an unencrypted (non-TLS) OCPP connection. The concrete trigger is a GetConfiguration message whose JSON "key" field exceeds 50 bytes (up to ~2048, bounded by CONFIG_OCPP_RECV_BUFFER_SIZE). Limiting factors: the OCPP client feature must be built in and connected; a TLS-secured, certificate-validated connection to a trusted central system blocks the MITM path and leaves only a malicious/compromised backend as the attack position; and whether the outcome is DoS or RCE depends on build-time stack hardening (canaries, MPU stack guard). No end-user interaction is required.

The raw signals point to high severity: the vendor CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), and the flaw is a remotely reachable stack overflow on a network-facing reader thread. However, several caveats temper the practical risk. Exploitation is not fully unauthenticated in the trust sense the vector implies: the attacker must control the configured central system endpoint or MITM an unencrypted (non-TLS) WebSocket connection - a charge point that validates its central system and uses TLS (wss://) substantially narrows the threat to a compromised/rogue backend. Whether the stack smash yields code execution versus only denial of service depends on build-time hardening (stack canaries, MPU/stack-guard configuration) that varies per Zephyr deployment. No KEV listing and no public exploit are known, and no EPSS score was provided, so there is no evidence of active or automated exploitation; the 9.8 reflects worst-case impact rather than demonstrated in-the-wild activity. Any operator running Zephyr-based OCPP charge points should nonetheless treat this as an urgent patch item given the memory-corruption primitive and network exposure. Note the vector's PR:N assumes the malicious server is a valid attacker position - verify against your deployment's trust model.

An attacker who operates or has compromised the central management system a charge point connects to - or who sits as a man-in-the-middle on an unencrypted WebSocket link - sends an OCPP GetConfiguration request whose "key" field is longer than 50 bytes. The oversized key is copied via unbounded strcpy() into the 50-byte stack buffer, overflowing the reader thread's stack and crashing the device or, depending on hardening, executing attacker-controlled code. No public proof-of-concept exploit has been identified at time of analysis, and low complexity (AC:L) means a single crafted message suffices.