CVE-2026-9395: Insufficiently Protected Credentials in Besen BS20 EV Charging Station
A vulnerability was identified in Besen BS20 EV Charging Station up to 20260426. Affected is an unknown function of the component BLE/UDP. The manipulation leads to insufficiently protected credentials. The attack needs to be initiated within the local network. The original disclosure mentions, that "[t]hese vulnerabilities have been reported to Besen and we have received their acknowlegement that they are reviewing this as of April 2026."
AI Analysis
Technical Summary
This vulnerability affects the Besen BS20 EV Charging Station firmware version 20260426 and involves insufficient protection of credentials in a BLE/UDP component function. The attack vector is local network access with low complexity and no user interaction required. The CVSS 4.0 base score is 5.1, indicating medium severity. The vendor has acknowledged the vulnerability and is reviewing it as of April 2026, but no patch or mitigation details have been provided.
Potential Impact
The vulnerability could allow an attacker with local network access and low privileges to manipulate or access credentials insufficiently protected by the device's BLE/UDP component. This could potentially lead to unauthorized access or control within the local network environment. No known exploits are reported in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor is reviewing the issue but has not released a fix, users should restrict local network access to the device and monitor for updates from Besen regarding patches or mitigations.
CVE-2026-9395: Insufficiently Protected Credentials in Besen BS20 EV Charging Station
Description
A vulnerability was identified in Besen BS20 EV Charging Station up to 20260426. Affected is an unknown function of the component BLE/UDP. The manipulation leads to insufficiently protected credentials. The attack needs to be initiated within the local network. The original disclosure mentions, that "[t]hese vulnerabilities have been reported to Besen and we have received their acknowlegement that they are reviewing this as of April 2026."
CVSS v4.0
Score 5.1medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects the Besen BS20 EV Charging Station firmware version 20260426 and involves insufficient protection of credentials in a BLE/UDP component function. The attack vector is local network access with low complexity and no user interaction required. The CVSS 4.0 base score is 5.1, indicating medium severity. The vendor has acknowledged the vulnerability and is reviewing it as of April 2026, but no patch or mitigation details have been provided.
Potential Impact
The vulnerability could allow an attacker with local network access and low privileges to manipulate or access credentials insufficiently protected by the device's BLE/UDP component. This could potentially lead to unauthorized access or control within the local network environment. No known exploits are reported in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor is reviewing the issue but has not released a fix, users should restrict local network access to the device and monitor for updates from Besen regarding patches or mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-05-24T06:18:55.457Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a135b18a5ae1af1aac8f880
Added to database: 05/24/2026, 20:10:00 UTC
Last enriched: 05/31/2026, 20:43:48 UTC
Last updated: 07/31/2026, 19:23:00 UTC
Views: 68
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.