This vulnerability affects the Besen BS20 EV Charging Station's BLE/WiFi component, enabling an attacker within the local network to perform a capture-replay attack that bypasses authentication. The attack complexity is high, and no privileges or user interaction are required for exploitation. The CVSS 4.0 base score is 2.3, reflecting low severity due to the attack vector and complexity. The vendor has acknowledged the vulnerability and is reviewing it, but no official fix or patch has been published to date.

Successful exploitation allows an attacker on the local network to bypass authentication mechanisms of the charging station, potentially enabling unauthorized access or control. However, the attack is highly complex and requires local network access, limiting the practical risk. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor is reviewing the issue and no official fix is available, users should restrict local network access to trusted parties and monitor for vendor updates. No specific mitigations have been provided by the vendor yet.