CVE-2026-9394 Details
Description
A vulnerability was determined in Besen BS20 EV Charging Station up to 20260426. This impacts an unknown function of the component Bluetooth Low Energy Handler. Executing a manipulation can lead to weak password requirements. The attack needs to be done within the local network. This attack is characterized by high complexity. The exploitability is said to be difficult. The original disclosure mentions, that "[t]hese vulnerabilities have been reported to Besen and we have received their acknowlegement that they are reviewing this as of April 2026."
A vulnerability exists in the Besen BS20 EV Charging Station, affecting versions through 20260426. The issue lies in the Bluetooth Low Energy (BLE) authentication mechanism, which imposes weak password requirements. The charger comes with a shared default password and mandates a fixed 6-digit numeric format, allowing for only 1,000,000 possible combinations. This limitation makes the device susceptible to brute-force attacks. Furthermore, the BLE authentication handshake can be intercepted and analyzed offline to crack passwords, potentially leading to unauthorized access and control of the charging station.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 24, 2026CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/carfeii/besen#finding-1-weak-authentication-mechanism-in-besen-home-ev-charging-station-via-ble | [email protected] | BundleExploitTechnical Description |
| https://vuldb.com/submit/813569 | [email protected] | Permission Required |
| https://vuldb.com/vuln/365375 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/365375/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-521 | Weak Password Requirements | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Besen BS20 EV Charging Station | <= 20260426 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 24, 2026 | New CVE Received | [email protected] |