This vulnerability involves improper authorization in an unknown functionality of the OTA Update Installation Handler in Besen BS20 EV Charging Station firmware version up to 20260426. The weakness allows remote attackers to potentially interfere with the update installation process without proper permissions. The attack complexity is high, and no privileges or user interaction are required for exploitation. The CVSS 4.0 base score is 9.2, indicating a critical severity level. Besen has acknowledged the vulnerability and is reviewing it as of April 2026, but no remediation or patch has been published yet.

Successful exploitation could allow remote attackers to bypass authorization controls in the OTA update mechanism of the charging station, potentially leading to unauthorized firmware modifications or other malicious actions related to the update process. This could compromise the integrity of the device's software. However, exploitation is difficult and requires high complexity. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Besen has acknowledged the vulnerability and is reviewing it, but no official fix or mitigation has been released. Until a patch is available, restrict remote access to the charging station's management interfaces and monitor for unusual activity related to OTA updates if possible.