A critical stack buffer overflow vulnerability in the Zephyr RTOS OCPP 1.6 client could allow a remote attacker to crash the system or achieve remote code execution.

The vulnerability is a memory-safety issue (CWE-787) involving an unbounded strcpy() operation when parsing incoming JSON configuration keys, allowing an attacker to overwrite stack memory.

The potential for remote code execution (RCE) on an embedded system like Zephyr presents a severe security risk, potentially allowing an attacker to gain full control over the device. Given the 9.8 CVSS score, this vulnerability could lead to operational disruption, loss of device integrity, and unauthorized access to the broader network environment in which the device operates.

Immediate Action: Update the Zephyr project source code to version 4.4.2 or higher, which includes the fix replacing the unsafe strcpy() with a bounded strncpy() function.

Proactive Monitoring: Monitor network traffic for malformed or unusually large OCPP GetConfiguration messages directed at charge point endpoints.

Compensating Controls: Ensure that communication between charge points and the central system is encrypted and authenticated to prevent man-in-the-middle attackers from injecting malicious payloads.

Public Exploit Available: Unknown

Developers and system integrators must prioritize updating to the patched version of the Zephyr RTOS. Because this is a low-level memory corruption issue, thorough testing of the updated firmware is required to ensure system stability following the security update.