CVE-2026-9396 Details

A vulnerability has been identified in the Besen BS20 EV Charging Station, affecting all versions prior to April 26, 2026. The issue arises from the firmware version check feature, which does not properly validate version responses during update checks. This flaw allows an attacker to intercept and alter the response to indicate a fictitious 'newer' version, thereby enabling the upgrade option even when the device is already up to date. Such manipulation can lead to user interface spoofing and misleading update notifications. The vulnerability can be exploited remotely, although the exploitation process is considered complex and challenging.