This vulnerability involves improper authorization in the OTA Update Installation Handler of the Besen BS20 EV Charging Station (version 20260426). It enables a remote attacker to potentially manipulate the update process without proper authorization. Exploitation complexity is high, and no privileges or user interaction are required. The vendor has acknowledged the issue and is reviewing it, but no official fix or patch has been published as of the latest information.

Successful exploitation could allow an attacker to bypass authorization controls in the OTA update mechanism of the charging station, potentially leading to unauthorized firmware updates or other unauthorized actions. Given the critical CVSS score, the impact could be severe, but exploitation is difficult and requires high complexity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Besen is aware of the vulnerability and reviewing it as of April 2026. Until an official fix is released, organizations should monitor vendor communications for updates. No specific mitigations or workarounds have been provided by the vendor at this time.