The parsing bug in CVE-2026-10848 is real — extract_string_field() uses strncpy with an unbounded strchr search, allowing reads past buffer limits when processing OCPP responses. But the CVE description misses the structural problem: this EV charger client was designed to blindly trust any OCPP central system it authenticated to. The over-read isn't triggered by an attacker sending malformed packets from outside; it's triggered by a DATA frame from a server the station already connected to.
This fundamentally changes the threat model. OCPP 1.6 makes the charging station the client — it initiates the connection, then processes inbound RPCs from whatever central endpoint it authenticated to. A compromised central server, or one impersonated via on-path attack, becomes a reliable remote DoS vector against every station that connects to it. That's a force multiplier the CVSS score doesn't capture: one compromised server can simultaneously trigger the vulnerability across an entire fleet.
The deployment reality compounds this. OCPP commonly runs over unencrypted ws:// in the field, meaning any network-level attacker who can intercept or redirect traffic to a charging station's management endpoint can impersonate the central system. Even with TLS (wss://), an attacker who compromises the charging network operator's infrastructure gains massed control over all connected stations. Charging networks are high-value targets with historically weak security postures — this isn't theoretical.
The experimental flag (CONFIG_OCPP) deserves scrutiny. Organizations frequently treat experimental code as exempt from code review obligations, and firmware builds routinely include experimental features through inherited Yocto layers or inherited configurations. The patch addresses the parsing bug, but the underlying assumption — that a remote OCPP server is a trustworthy input source — remains embedded in the protocol design. This is a recurring pattern across remote management client implementations: TR-069 CWMP, MOTT, and OCPP all followed the same trajectory where authenticated-server classification created institutional permission to skip bounds checking.
Check your deployment inventory for stations with CONFIG_OCPP enabled, regardless of whether they were intentionally deployed as experimental. If you operate charging infrastructure, verify whether your central server connections use wss:// and whether the operator monitors for central server compromise. The installed base provisioned over plain websocket isn't going away through software updates alone — retrofitting TLS requires physical access and operator coordination.