THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-10848 (HIGH 7.0) — The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) using a hand-rolled helper, extract_string_field(), that copied the message's uid and action fields with strncpy(out_buf, token + 1, outlen - 1) and then sc

[NVD] CVE-2026-10848 (HIGH 7.0) — The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) using a hand-rolled helper, extract_string_field(), that copied the message's uid and action fields with strncpy(out_buf, token + 1, outlen - 1) and then sc

mednvdPublished 2026-08-02

CVE-2026-10848 CVSS: 7.0 HIGH Published: 2026-08-02T17:16:58.163

The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) using a hand-rolled helper, extract_string_field(), that copied the message's uid and action fields with strncpy(out_buf, token + 1, outlen - 1) and then scanned the result with strchr(out_buf, '"'). Because st

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-10848