CVE-2026-10848: Zephyr RTOS OCPP Client Parser Issue
TL;DR - Zephyr’s OCPP 1.6 client mishandles long, malformed inbound RPC fields. - Systems using the vulnerable OCPP client should patch to the upstream fixed commit immediately. - Exploitation in the wild is not confirmed, but network reachability makes this urgent.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-10848 |
| CVSS | 7.0 |
| Attack vector | Network, via inbound websocket OCPP/WAMP RPC frames |
| Privileges required | Unknown from retrieved CVSS vector; practically, no local privileges on the target are described |
| Patch available | Yes, upstream fix commit is available |
CVE-2026-10848 affects the Zephyr Project’s OCPP 1.6 client implementation in subsys/net/lib/ocpp. The issue is triggered while parsing inbound WAMP RPC frames received from the OCPP central system over websocket. According to the NVD description, malformed uid or action fields can cause an out-of-bounds read and, in some cases, a one-byte out-of-bounds NUL write.
This matters because the vulnerable parsing path handles data received directly from the network. In practical terms, a malicious or compromised central server can send a crafted frame to the client. The NVD description also notes that OCPP is commonly deployed over plain ws://, which means an on-path attacker may be able to tamper with traffic in some real-world charging infrastructure environments.
What Is This Vulnerability?
At its core, this is a memory-safety bug caused by unsafe string handling in the Zephyr OCPP 1.6 client parser. The NVD description identifies parse_rpc_msg() in subsys/net/lib/ocpp/ocpp_j.c and helper functions including extract_string_field() and extract_payload() as the vulnerable logic. The primary defect comes from copying attacker-controlled string content with strncpy(out_buf, token + 1, outlen - 1) and then scanning the destination buffer with strchr(out_buf, '"').
The problem is that strncpy() does not guarantee NUL termination when the source length is at least outlen - 1. In the described case, if the inbound uid or action field is 127 bytes or longer and lacks a closing quote, the 128-byte destination buffer may remain unterminated. The follow-on strchr() then searches past the end of the intended buffer into adjacent stack memory. If it encounters a quote beyond the boundary, a one-byte out-of-bounds NUL write may also occur.
A related issue exists in extract_payload(). There, strchr() and strrchr() are used on a receive buffer that may not be NUL-terminated when a maximal-length frame fills the buffer. That means parsing can also overrun the intended bounds of the receive data and inspect memory that should not be part of the parse operation.
Technical Notes
The core pattern described by NVD looks like this:
strncpy(out_buf, token + 1, outlen - 1);
char *end = strchr(out_buf, '"');
If token + 1 points to an attacker-supplied string of outlen - 1 bytes or more without a terminating quote inside the copied region, out_buf may not be NUL-terminated before strchr() runs.
The attack precondition described in the advisory context is an inbound OCPP/WAMP RPC frame with a long uid or action field:
[2,"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","BootNotification",{"chargePointVendor":"X","chargePointModel":"Y"}]
A malformed variant omitting the expected closing quote in the targeted field is the important trigger condition described by NVD.
Who Is Affected?
Affected deployments are Zephyr RTOS builds that include the OCPP 1.6 client in subsys/net/lib/ocpp. The vulnerable code is in the Zephyr Project source tree, specifically in subsys/net/lib/ocpp/ocpp_j.c and subsys/net/lib/ocpp/ocpp.c, where inbound websocket data is parsed after being received by websocket_recv_msg().
The exact affected version range was not exposed in the retrieved primary-source text. That means it would be inaccurate to claim a specific semver range without stronger source support. The defensible statement is that versions containing the vulnerable OCPP 1.6 client code prior to the upstream fix commit are affected.
The fixed release version number is also not confirmed in the retrieved source material. What is confirmed is the upstream remediation commit:
e500f7b81b5b8a867e28b2f4e59512cbfdd5ae75
Because the released fixed version number was not available from the source text retrieved here, defenders should assume any Zephyr build using the affected OCPP client code and lacking this fix is vulnerable until proven otherwise.
For operators, the practical question is not only Zephyr versioning but feature exposure. If your build does not include the OCPP 1.6 client, this CVE is likely not relevant. If it does, especially in EV charging or related embedded management scenarios using websocket-connected OCPP backends, the issue is operationally relevant even without confirmed in-the-wild exploitation.
CVSS Score Breakdown
The base score published by NVD is 7.0. The full CVSS vector string was not provided in the returned NVD tool output used for this article, so individual metric values such as Attack Complexity, User Interaction, or Scope cannot be quoted verbatim from the source.
Even without the vector string, the score aligns with the described behavior: the bug is remotely reachable through network-originated protocol traffic, impacts memory safety, and can plausibly lead to denial of service or other undefined behavior. The NVD description does not claim remote code execution, so practitioners should avoid overstating the impact beyond what the source supports.
The attack vector is effectively network-based because the vulnerable code processes inbound websocket messages from the OCPP central server. Privileges required on the target are not described as necessary in the available source text. In practice, the attacker model is either control of the central system endpoint or the ability to tamper with traffic on-path, particularly where plain ws:// is in use.
When exact CVSS submetrics are unavailable, defenders should treat the score as a strong prioritization signal but rely more heavily on deployment context. If the OCPP client is exposed to external or semi-trusted infrastructure, patching urgency is higher than the score alone may convey.
Exploitation Status
At the time of writing, there is no CISA Known Exploited Vulnerabilities catalog listing for CVE-2026-10848. That means there is no CISA-backed confirmation that the vulnerability is being actively exploited in the wild. Specifically, the KEV status is false in the research note.
There is also no confirmed public proof-of-concept from the retrieved authoritative sources used here. The NVD references point to the upstream fix commit and a GitHub security advisory, but the research note did not identify a separate PoC repository or exploit release. Therefore, the most accurate statement is:
- Public PoC: not confirmed from retrieved sources
- Active exploitation in the wild: not confirmed
- KEV-listed: no
That said, the exploit path is clearly described and appears technically feasible. The vulnerable parser accepts untrusted inbound OCPP/WAMP data from a central server. The trigger condition is straightforward: a crafted RPC frame with an oversized uid or action field and malformed quoting. In environments where OCPP is carried over unencrypted websocket, an on-path attacker may have an easier time reaching the vulnerable path than in deployments using protected transport.
Defenders should not equate “no known exploitation” with “low risk.” This is exactly the kind of bug that can move quickly from advisory to weaponized testing once protocol-aware researchers examine the patch and affected parsing logic.
How to Detect It
Detection starts with asset and code-path identification. Determine whether your Zephyr-based devices include the OCPP 1.6 client under subsys/net/lib/ocpp, and whether they maintain websocket sessions with a central system. If that feature is absent, this CVE is likely out of scope. If present, inspect whether your firmware baseline includes upstream commit e500f7b81b5b8a867e28b2f4e59512cbfdd5ae75 or an equivalent downstream backport.
Next, look for malformed inbound OCPP/WAMP frames, especially unusually long uid or action fields near or above 127 bytes, or parse failures associated with websocket data processing. The exact log message format depends on your Zephyr build and application logging configuration, so there is no guaranteed vendor-provided signature in the source material. In the absence of canonical log strings, defenders should monitor for protocol anomalies, unexpected resets, crashes, or watchdog events on charging devices after receiving malformed central-system traffic.
Technical Notes
A practical network-side detection strategy is to flag OCPP CALL messages with suspiciously long second or third JSON array elements. For example, a simplified Suricata-style content idea for unencrypted websocket payload inspection could focus on OCPP CALL frames beginning with [2, and unusually long quoted fields:
Alert on websocket payloads matching:
- prefix: [2,"
- second or third quoted field length >= 127 bytes
- missing expected closing quote before subsequent delimiter
If you have packet capture or proxy visibility into plaintext OCPP traffic, a rough grep or jq-assisted review of websocket payload logs can help identify suspicious messages:
grep -E '\[2,"[^"]{127,}' ocpp_ws_payloads.log
For SIEM pipelines that store websocket payload text, a generic query pattern might look like:
SELECT timestamp, src_ip, dst_ip, payload
FROM websocket_events
WHERE payload LIKE '[2,"%'
AND LENGTH(REGEXP_SUBSTR(payload, '^\[2,"([^"]+)', 1, 1, NULL, 1)) >= 127;
If the field is malformed and lacks a closing quote, regex extraction may fail. That failure itself can be a useful anomaly signal when correlated with device instability or reconnect storms.
On endpoints, watch for application crashes, repeated websocket reconnects, parser errors, or device resets shortly after receiving central-system messages. Because the known impact includes out-of-bounds reads and a possible one-byte write, symptoms may range from clean crashes to intermittent undefined behavior rather than a consistent error signature.
Mitigation and Patching
The most reliable mitigation is to apply the upstream Zephyr fix corresponding to commit e500f7b81b5b8a867e28b2f4e59512cbfdd5ae75. A patch is available upstream. However, the exact fixed release version number was not confirmed in the retrieved source text, so this article cannot responsibly name a specific release tag. If you consume Zephyr through a downstream vendor SDK or board support package, confirm whether that commit has been backported into your maintained branch.
If immediate patching is not possible, reduce exposure around the OCPP communication path. Prioritize use of encrypted and authenticated transport rather than plain ws://. Restrict which central systems can connect or be connected to, segment charging infrastructure from untrusted networks, and monitor for malformed websocket frames. These are interim risk-reduction steps, not substitutes for code remediation.
Another temporary control is to disable the OCPP client component in firmware builds where it is not required. If your product includes the code but does not operationally need OCPP 1.6, removing the feature from the build eliminates the vulnerable parser path. Similarly, if you operate test or staging deployments that talk to less-trusted central systems, isolate those environments until patched firmware is available.
Technical Notes
If you track Zephyr as a Git dependency, verify and pull the fixed commit:
git fetch origin
git show e500f7b81b5b8a867e28b2f4e59512cbfdd5ae75
git cherry-pick e500f7b81b5b8a867e28b2f4e59512cbfdd5ae75
If you maintain a west-based Zephyr workspace, update the Zephyr revision to a branch or manifest containing the fix, then rebuild:
west update zephyr
west build -b <your_board> <your_app>
If you need a temporary build-time workaround and can safely remove OCPP functionality, disable or exclude the OCPP client from the application configuration and build manifest. The exact Kconfig or application integration knob was not provided in the retrieved sources, so administrators should consult their own firmware project and board integration rather than guessing at a symbol name.
For network hardening, move OCPP traffic to protected transport where supported and block plaintext websocket exposure where feasible. Even without a public PoC, the NVD description explicitly calls out the risk of on-path tampering when ws:// is used.
References
The primary reference for technical details is the NVD entry for CVE-2026-10848, which describes the root cause, vulnerable functions, and attack conditions. That description is the basis for the memory-safety analysis and the practical trigger scenario discussed above.
The confirmed upstream remediation artifact is the Zephyr Project commit:
- Zephyr fix commit:
https://github.com/zephyrproject-rtos/zephyr/commit/e500f7b81b5b8a867e28b2f4e59512cbfdd5ae75
Additional official project references associated with this CVE include:
- GitHub security advisory:
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-jgqq-7mjj-w642 - Zephyr Project security vulnerabilities page:
https://docs.zephyrproject.org/latest/security/vulnerabilities.html - Zephyr repository security documentation source:
https://github.com/zephyrproject-rtos/zephyr/blob/main/doc/security/vulnerabilities.rst
For further reading on related security practices, check out our articles on websocket security and best WAF services compared.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you. ```