CVE-2026-9397 - Besen BS20 EV Charging Station OTA Update Installation improper authorization

Back Back to CVE browser

CRITICAL

Besen BS20 EV Charging Station OTA Update Installation improper authorization

Published May 24, 2026

9.2

CRITICAL

CVSS 4.0

EPSS 0.77%

Description

A weakness has been identified in Besen BS20 EV Charging Station up to 20260426. Affected by this issue is some unknown functionality of the component OTA Update Installation Handler. This manipulation causes improper authorization. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The original disclosure mentions, that "[t]hese vulnerabilities have been reported to Besen and we have received their acknowlegement that they are reviewing this as of April 2026."

Affected products

Vendor Besen Product BS20 EV Charging Station Default
n/a
- Version
  20260426
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Besen

BS20 EV Charging Station

n/a

Version	Status	Constraints
20260426	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-266

Incorrect Privilege Assignment

CWE-285

References (4)

https://github.com/carfeii/besen#finding-4-unauthorized-firmware-installation-via-spoofed-ota-updates
patch
https://vuldb.com/submit/813576
third-party-advisory
https://vuldb.com/vuln/365378
vdb-entry
https://vuldb.com/vuln/365378/cti
signaturepermissions-required

Link	Providers	Tags
https://github.com/carfeii/besen#finding-4-unauthorized-firmware-installation-via-spoofed-ota-updates		patch
https://vuldb.com/submit/813576		third-party-advisory
https://vuldb.com/vuln/365378		vdb-entry
https://vuldb.com/vuln/365378/cti		signaturepermissions-required