A memory corruption vulnerability in Zephyr RTOS versions 4.3.0 through 4.4.9 poses a significant risk of denial-of-service or unauthorized data access.

This vulnerability involves out-of-bounds read and write flaws (CWE-125 and CWE-787) within the OCPP 1 stack. The attack vector is network-based and does not require user interaction or prior authentication to trigger.

Successful exploitation of these memory bounds errors can lead to a crash of the affected device or the potential for arbitrary code execution. Given the CVSS score of 7.0, this represents a high-severity risk that could cause critical system downtime in industrial or IoT environments relying on the Zephyr RTOS.

Immediate Action: Upgrade to Zephyr RTOS version 4.5.0 or later to incorporate the necessary memory safety fixes.

Proactive Monitoring: Review network traffic and system logs for unexpected behavior or crash events originating from the OCPP interface.

Compensating Controls: Implement network segmentation to restrict access to devices running the affected OCPP service, thereby limiting the exposure to untrusted network segments.

Public Exploit Available: No — there is no confirmed public exploit available in the current data.

Organizations utilizing the Zephyr RTOS should prioritize the migration to version 4.5.0 to address these critical memory bounds vulnerabilities. Given the potential for service disruption, testing and deployment of this patch should be scheduled immediately to ensure the integrity and availability of embedded systems.