CVE-2026-9395: Besen BS20 Credential Protection Flaw

CVE-2026-9395 Overview

CVE-2026-9395 affects the Besen BS20 EV Charging Station up to firmware version 20260426. The vulnerability resides in an undisclosed function within the Bluetooth Low Energy (BLE) and User Datagram Protocol (UDP) communication component. Attackers on the local network can exploit insufficiently protected credentials [CWE-522] to harvest sensitive authentication data exchanged between the charger and its companion mobile application. According to the original disclosure, the issue was reported to Besen, and the vendor acknowledged review of the finding as of April 2026.

Critical Impact
An adjacent-network attacker with low privileges can intercept cleartext credentials transmitted over BLE and UDP, enabling unauthorized control of the EV charging station.

Affected Products

Besen BS20 EV Charging Station firmware up to 20260426
BLE communication interface used for device pairing and configuration
UDP-based local network control channel

Discovery Timeline

April 2026 - Vulnerability reported to Besen; vendor acknowledged review
2026-05-24 - CVE-2026-9395 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9395

Vulnerability Analysis

The Besen BS20 EV Charging Station transmits authentication material over BLE and UDP without adequate confidentiality protection. The component does not enforce encryption or apply a secure key-exchange mechanism before exchanging credentials with the pairing client. An attacker positioned within BLE range or on the same local IP segment can passively capture this traffic.

The weakness maps to [CWE-522] Insufficiently Protected Credentials. The Exploit Prediction Scoring System reports an EPSS probability of 0.015%, reflecting limited observed exploitation interest. However, the proof-of-concept is publicly available on GitHub, which lowers the barrier for opportunistic attackers within wireless or LAN proximity to the device.

Root Cause

The root cause is the use of unauthenticated, unencrypted transport for sensitive material across both the BLE pairing channel and the UDP control plane. The charging station relies on network locality as the only access control boundary. Credentials traverse the wire in cleartext, allowing trivial recovery through standard packet capture tools such as tcpdump, Wireshark, or BLE sniffers like hcidump.

Attack Vector

Exploitation requires adjacent-network access, meaning the attacker must be within BLE radio range or attached to the same Wi-Fi or Ethernet segment as the charging station. Low privileges are sufficient. Once positioned, the attacker captures BLE advertisements, pairing exchanges, or UDP datagrams containing credentials. The recovered material can then be replayed against the device or its management application to gain unauthorized control. Refer to the GitHub PoC Repository for the disclosed exploitation methodology.

Detection Methods for CVE-2026-9395

Indicators of Compromise

Unexpected BLE pairing events or advertisement scans near the charging station outside normal operating hours.
UDP traffic on the local segment containing recognizable credential strings or device identifiers in cleartext.
Unauthorized configuration changes or charging sessions initiated from devices not previously associated with the unit.

Detection Strategies

Monitor wireless spectrum for rogue BLE clients enumerating or connecting to the BS20 device.
Inspect LAN traffic for plaintext authentication tokens transiting UDP between the charger and mobile clients.
Correlate charger management API events with the source IP and MAC addresses of authorized administrative endpoints.

Monitoring Recommendations

Deploy network sensors on the VLAN hosting IoT and EV infrastructure to flag anomalous UDP flows.
Log all BLE pairing attempts where the device or vendor supports diagnostic logging.
Establish a baseline of expected client MAC and IP addresses interacting with the charging station and alert on deviations.

How to Mitigate CVE-2026-9395

Immediate Actions Required

Isolate the Besen BS20 charging station on a dedicated VLAN with strict access control lists limiting which hosts can reach it.
Disable BLE pairing when not in active use, where the device firmware exposes that option.
Restrict physical and wireless proximity to the unit by relocating it away from public spaces or enabling Wi-Fi client isolation.

Patch Information

No vendor patch is currently published. Besen acknowledged the report and indicated the finding was under review as of April 2026. Track the VulDB Vulnerability #365376 entry and vendor channels for firmware updates addressing the cleartext credential transmission.

Workarounds

Place the charger behind a network segment that requires VPN or 802.1X authentication for administrative access.
Use a Wi-Fi network with WPA3 enterprise authentication to reduce the population of adjacent attackers on the same broadcast domain.
Rotate any credentials configured on the device and assume prior values may be compromised if the unit operated on an untrusted network.

bash

# Example: restrict the charging station VLAN to authorized management hosts
iptables -A FORWARD -s 10.50.10.0/24 -d 10.50.99.20 -p udp --dport 5683 -j ACCEPT
iptables -A FORWARD -d 10.50.99.20 -j DROP