CVE-2026-9398 Details
Description
A security vulnerability has been detected in Besen BS20 EV Charging Station up to 20260426. This affects an unknown part of the component BLE/WiFi. Such manipulation leads to authentication bypass by capture-replay. The attack must be carried out from within the local network. Attacks of this nature are highly complex. It is indicated that the exploitability is difficult. The original disclosure mentions, that "[t]hese vulnerabilities have been reported to Besen and we have received their acknowlegement that they are reviewing this as of April 2026."
An authentication bypass vulnerability has been identified in the Besen BS20 EV Charging Station, affecting versions through 20260426. The vulnerability arises in the BLE/WiFi component, where an attacker can exploit capture-replay techniques to bypass authentication. This manipulation must be executed from within the local network, and while the original disclosure indicates that such attacks are highly complex, the vulnerability remains a significant concern.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 24, 2026CISA-ADP
Assessed May 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/carfeii/besen#finding-5-unauthorized-tampering-of-charger-commands | [email protected] | BundleExploitTechnical Description |
| https://vuldb.com/submit/813577 | [email protected] | Permission Required |
| https://vuldb.com/vuln/365379 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/365379/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-294 | Authentication Bypass by Capture-replay | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Besen BS20 EV Charging Station | <= 20260426 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 24, 2026 | New CVE Received | [email protected] |