CVE-2026-9396: Besen BS20 EV Charging Station RCE Flaw

CVE-2026-9396 Overview

CVE-2026-9396 affects the Besen BS20 Electric Vehicle (EV) Charging Station through firmware build 20260426. The flaw resides in the Firmware Version Check component, which improperly restricts rendered user interface (UI) layers [CWE-1021]. An attacker can manipulate the version-check logic remotely to spoof UI elements and mislead operators about the device state. The disclosure notes that exploitation requires high attack complexity and is considered difficult to execute reliably. According to the original disclosure, the issues were reported to Besen, who acknowledged review of the report as of April 2026.

Critical Impact
Remote manipulation of the firmware version display enables UI spoofing on the EV charging station, potentially deceiving operators into trusting an unpatched or tampered device state.

Affected Products

Besen BS20 EV Charging Station
Firmware versions up to and including build 20260426
Firmware Version Check component

Discovery Timeline

April 2026 - Vulnerability reported to Besen; vendor acknowledged review
2026-05-24 - CVE-2026-9396 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9396

Vulnerability Analysis

The vulnerability is classified under [CWE-1021] Improper Restriction of Rendered UI Layers or Frames, commonly associated with UI redress and clickjacking-style attacks. In this case, the affected functionality is the Firmware Version Check in the Besen BS20 charging station. By manipulating data consumed during the version-check rendering path, an attacker can overlay or substitute UI elements presented to the operator.

The attack is remote and does not require authentication or user interaction. However, the disclosure characterizes the attack complexity as high, indicating that the attacker must satisfy specific preconditions to reliably trigger the spoofing condition. Impact is limited to integrity of displayed information; confidentiality and availability of the device are not directly affected.

The EPSS probability for this CVE is approximately 0.028%, reflecting a low likelihood of opportunistic exploitation in the near term.

Root Cause

The root cause is improper restriction of rendered UI layers in the firmware version verification workflow. The component fails to validate or constrain the source and rendering context of UI elements tied to firmware version display, allowing an attacker-controlled layer to be drawn over the legitimate interface.

Attack Vector

The attack vector is network-based. An attacker reachable over the network can interact with the charging station's management interface and influence the firmware version check rendering. Successful exploitation produces a spoofed UI that misrepresents the firmware state, potentially convincing an administrator that the device is patched, healthy, or running trusted firmware when it is not.

No verified exploit code is publicly available. Technical analysis is documented in the GitHub Firmware Exploit Analysis and the VulDB Vulnerability #365377 entry.

Detection Methods for CVE-2026-9396

Indicators of Compromise

Unexpected discrepancies between the firmware version displayed in the BS20 management UI and the version reported by out-of-band inventory or vendor records.
Anomalous HTTP responses or rendered frames originating from the charging station's version-check endpoint.
Unauthorized network connections to the BS20 management interface from non-administrative source addresses.

Detection Strategies

Compare firmware version banners observed on the network with cryptographic hashes of expected firmware images supplied by Besen.
Inspect web traffic to and from the charging station for embedded frames, overlay elements, or version strings inconsistent with the deployed build.
Baseline normal administrative access patterns to the BS20 device and alert on deviations.

Monitoring Recommendations

Centralize logs from EV charging infrastructure and correlate firmware reporting events across the fleet.
Monitor for repeated or scripted access to the firmware version check endpoint from a single source.
Track operator interactions with the BS20 UI and flag administrative actions taken immediately after a version-check page load.

How to Mitigate CVE-2026-9396

Immediate Actions Required

Restrict network access to the BS20 management interface to trusted administrative networks only.
Verify deployed firmware versions out-of-band using vendor-supplied checksums rather than relying on the device UI.
Subscribe to Besen advisories for the forthcoming patch addressing CVE-2026-9396.

Patch Information

As of the NVD publication date, Besen has acknowledged the report and is reviewing the findings. No vendor patch URL is listed in the NVD entry. Operators should track the VulDB Vulnerability #365377 record and the GitHub Firmware Exploit Analysis for updates on remediation availability.

Workarounds

Place BS20 chargers behind a network segment that blocks inbound access from untrusted hosts.
Require administrators to validate firmware status from a secondary management channel before approving updates or maintenance.
Disable or limit remote management features on the charging station where operationally feasible.

bash

# Configuration example: restrict access to the BS20 management interface
# Replace 10.0.0.0/24 with your administrative network and <BS20_IP> with the device address
iptables -A INPUT -p tcp -s 10.0.0.0/24 -d <BS20_IP> --dport 443 -j ACCEPT
iptables -A INPUT -p tcp -d <BS20_IP> --dport 443 -j DROP