CVE-2023-49955
📋 TL;DR
This vulnerability in Dalmann OCPP.Core allows attackers to send BootNotification messages with excessively large chargePointVendor fields, causing server instability and denial of service. It affects electric vehicle charging systems using OCPP.Core before version 1.2.0. The vendor notes the software is intended for protected environments, but any exposed implementation is vulnerable.
💻 Affected Systems
- Dalmann OCPP.Core
📦 What is this software?
Open Charge Point Protocol by Dallmann Consulting
⚠️ Risk & Real-World Impact
Worst Case
Complete server crash and prolonged denial of service for all connected charging stations, potentially disrupting EV charging operations.
Likely Case
Server instability causing intermittent service disruptions and degraded performance for charging station communications.
If Mitigated
Minimal impact if proper input validation and network segmentation are implemented.
🎯 Exploit Status
Exploitation requires sending specially crafted BootNotification messages; no authentication needed for the vulnerable field.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.0
Vendor Advisory: https://github.com/dallmann-consulting/OCPP.Core/issues/32
Restart Required: Yes
Instructions:
1. Update OCPP.Core to version 1.2.0 or later
2. Restart the OCPP.Core service
3. Verify the update was successful
🔧 Temporary Workarounds
Input Validation Filter
allImplement custom input validation for chargePointVendor field length before processing BootNotification messages.
Network Segmentation
allIsolate OCPP.Core servers from untrusted networks as recommended by vendor.
🧯 If You Can't Patch
- Implement network-level filtering to block oversized OCPP messages
- Deploy rate limiting on OCPP endpoints to reduce DoS impact
🔍 How to Verify
Check if Vulnerable:
Check OCPP.Core version; if below 1.2.0, the system is vulnerable.Check Version:
Check application configuration or package manager for OCPP.Core versionVerify Fix Applied:
Confirm OCPP.Core version is 1.2.0 or higher and test with oversized chargePointVendor field.📡 Detection & Monitoring
Log Indicators:
- Unusually large BootNotification messages
- Server crash/restart logs
- High memory usage alerts
Network Indicators:
- Oversized OCPP packets
- Multiple BootNotification requests with large payloads
SIEM Query:
source="ocpp.log" AND message_size>threshold AND command="BootNotification"