CVE-2026-13217 zephyrproject CVE debrief

Who should care

Defenders of Zephyr-based charge points and other systems using the OCPP 1.6 client should assess exposure and prioritize patching to prevent potential denial of service attacks. This includes reviewing the system's architecture and identifying potential entry points for the vulnerability. Additionally, defenders should validate and sanitize all uid fields from network data and implement additional checks for strtok_r return values. It is also essential to

Why it matters

CVE-2026-13217 is a medium-severity vulnerability in the Zephyr OCPP 1.6 client that can lead to a denial of service. Defenders should prioritize patching and validating uid fields to prevent potential impacts.

• Denial of service on platforms that trap access to address 0.
• Potential for availability impact on affected systems.
• Need for validation and sanitization of uid fields from network data.
• Importance of monitoring for similar vulnerabilities in OCPP clients and network-facing components.

Technical summary

The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLRESULT message. A malicious central system or man-in-the-middle can exploit this by providing a malformed uid, leading to a NULL pointer dereference and a denial of service on platforms that trap access to address 0. The vulnerability is caused by the OCPP 1.6 client's handling of CALLRESULT messages, and the impact is limited to a denial of service on platforms that trap access to address 0. The applied fix guards only the first atoi(); however, the second strtok_r(NULL, -, &tmp) followed by pdu = atoi(buf) in the same function remains unguarded and the identical NULL dereference is still The

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided patches to prevent NULL pointer dereferences.
• Validate and sanitize all uid fields from network data.
• Implement additional checks for strtok_r return values.
• Monitor for similar vulnerabilities in the OCPP client and other network-facing components.
• Perform a thorough review of the system's exposure to this vulnerability.
• Consider implementing compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions and retest remediated assets to ensure the vulnerability is properly addressed.

Evidence notes

The vulnerability is caused by the OCPP 1.6 client's handling of CALLRESULT messages. A malicious central system or man-in-the-middle can exploit this by providing a malformed uid, leading to a NULL pointer dereference. The impact is limited to a denial of service on platforms that trap access to address 0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.