CVE-2026-9395 Details
Description
A vulnerability was identified in Besen BS20 EV Charging Station up to 20260426. Affected is an unknown function of the component BLE/UDP. The manipulation leads to insufficiently protected credentials. The attack needs to be initiated within the local network. The original disclosure mentions, that "[t]hese vulnerabilities have been reported to Besen and we have received their acknowlegement that they are reviewing this as of April 2026."
A vulnerability exists in the Besen BS20 EV Charging Station, affecting versions through April 26, 2026. The issue arises from an unknown function in the BLE/UDP component, leading to the exposure of user credentials in plaintext. This vulnerability requires local network access to exploit. Operations such as password changes reveal both old and new passwords in cleartext, and the plaintext passwords are frequently broadcasted via UDP, making them accessible to any attacker on the same local network.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 24, 2026CISA-ADP
Assessed May 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/carfeii/besen#finding-2-cleartext-credential-exposure-via-ble-and-udp-in-besen-home-ev-charging-station | [email protected] | BundleExploitTechnical Analysis |
| https://vuldb.com/submit/813572 | [email protected] | Permission Required |
| https://vuldb.com/vuln/365376 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/365376/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Besen BS20 EV Charging Station | <= 20260426 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 24, 2026 | New CVE Received | [email protected] |