CVE-2026-13217: NULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok_r/atoi
The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLRESULT message. In ocppprocessservermsg() the code calls atoi(strtokr(uid, "-", &tmp)) without checking the strtokr return value. When the server-supplied uid is empty or contains no - delimiter, strtokr() returns NULL and atoi(NULL) dereferences a NULL pointer, which is undefined behaviour.
The uid originates from network data: parserpcmsg() in subsys/net/lib/ocpp/ocppj.c JSON-parses a frame received from the OCPP central system over TCP/WebSocket and copies the server-controlled string into the local buffer. A malicious or compromised central system, or a man-in-the-middle on a non-TLS ws:// connection, can return a malformed uid to reach the defect. No authentication beyond the existing server connection (or MITM position) is required, and the reconstructed pointer is membership-validated by ocppsessionisvalid(), so the impact is limited to the NULL dereference rather than arbitrary pointer use.
On Zephyr targets that trap access to address 0 (MMU/MPU platforms or CONFIGNULLPOINTEREXCEPTIONDETECTION), the dereference faults inside the OCPP reader thread and invokes the fatal handler, producing a remote denial of service of the charge point; on bare targets where address 0 is readable the call returns 0 and is benign, so the impact is availability-only and platform-conditional.
The applied fix guards only the first atoi(); the second strtokr(NULL, "-", &tmp) followed by pdu = atoi(buf) in the same function remains unguarded and the identical NULL dereference is still reachable from the same network input when the uid has a first token but no second --delimited token. A complete fix should validate the second token as well.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In ocpp_process_server_msg(), validate the return value of the second strtok_r(NULL, "-", &tmp) that produces the PDU token (before pdu = atoi(buf)), and similarly guard the first token; only proceed with parsing when strtok_r() returns non-NULL to prevent NULL-pointer dereference.
Zephyr OCPP (subsys/net/lib/ocpp, ocpp_process_server_msg()) Guard NULL return from strtok_r() before calling atoi() = Implement checks so that both strtok_r(uid, "-", &tmp) and the subsequent strtok_r(NULL, "-", &tmp) return non-NULL pointers before calling atoi() - Compensating control
Ensure OCPP central-system communications use TLS (avoid ws:// non-TLS WebSocket) to reduce the chance that a MITM can inject malformed uid data.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the Zephyr OCPP 1.6 client are exposed when they process CALLRESULT messages from an OCPP central system. The vulnerable path is reachable from frames received over TCP/WebSocket.
What does an attacker need to exploit the flaw?
An attacker needs to control or compromise the configured OCPP central system, or be able to intercept and modify traffic on a non-TLS ws:// connection. They do not need additional authentication beyond the existing server connection or that network position.
What is the practical impact on affected targets?
A malformed empty uid or uid without a hyphen can cause a NULL-pointer dereference while the OCPP client reads a server message. On targets that trap accesses to address 0, including MMU/MPU platforms or systems using CONFIG_NULL_POINTER_EXCEPTION_DETECTION, this faults in the OCPP reader and can cause a denial of service.