CVE-2026-9397: Besen BS20 EV Auth Bypass Vulnerability

CVE-2026-9397 Overview

CVE-2026-9397 is an improper authorization vulnerability [CWE-266] in the Besen BS20 EV Charging Station firmware up to version 20260426. The flaw resides in the OTA (Over-the-Air) Update Installation Handler, which fails to properly validate authorization before accepting firmware updates. Remote attackers can exploit this weakness to install spoofed firmware images on affected charging stations. The vendor was notified in April 2026 and acknowledged the report. Exploitation requires a high degree of attack complexity, but no authentication or user interaction is needed.

Critical Impact
Successful exploitation enables unauthorized firmware installation on Besen BS20 EV Charging Stations, compromising device integrity, confidentiality, and availability across deployed charging infrastructure.

Affected Products

Besen BS20 EV Charging Station firmware versions up to 20260426
Component: OTA Update Installation Handler
Deployment: Networked EV charging infrastructure

Discovery Timeline

April 2026 - Vulnerabilities reported to Besen; vendor acknowledged review
2026-05-24 - CVE-2026-9397 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9397

Vulnerability Analysis

The vulnerability stems from an improper authorization weakness [CWE-266] in the OTA Update Installation Handler of the Besen BS20 EV Charging Station. The handler accepts and installs firmware images without enforcing adequate authorization checks on the source or integrity provenance of the update payload. This permits a remote, unauthenticated attacker to push spoofed OTA updates to the device. The attack vector is network-based, and the issue affects firmware images up to 20260426.

Research published in the GitHub Unauthorized Firmware Research repository documents the issue as Finding 4, describing how spoofed OTA updates can be delivered to vulnerable units. The CVSS 4.0 vector reflects high impact across confidentiality, integrity, and availability of the vulnerable system, with high attack complexity reducing the practical exploitability.

Root Cause

The root cause is missing or insufficient authorization enforcement in the firmware update routine. The device does not adequately verify whether an incoming firmware update originates from an authorized source. This category of flaw, classified under [CWE-266] (Incorrect Privilege Assignment), grants unauthorized actors privileges they should not possess during the update workflow.

Attack Vector

A remote attacker reachable on the charging station's network can craft and deliver a spoofed OTA firmware package to the update handler. Because authorization is improperly handled, the device accepts the malicious update and installs it. Once installed, attacker-controlled firmware can subvert the charging station's behavior, exfiltrate operational data, manipulate billing or charging logic, and persist across reboots. According to the disclosure, the exploitation is difficult to perform, requiring specific conditions to be met for success.

No verified public exploit code is available. See the GitHub Unauthorized Firmware Research writeup and the VulDB #365378 entry for additional technical context.

Detection Methods for CVE-2026-9397

Indicators of Compromise

Unexpected firmware version strings reported by BS20 charging stations that do not match vendor-released builds
Outbound or inbound connections to the OTA update endpoint from non-vendor IP ranges
OTA update events occurring outside scheduled maintenance windows
Device reboots immediately following inbound traffic to the update handler

Detection Strategies

Monitor network traffic to and from BS20 charging stations for unauthorized OTA update sessions and unexpected firmware transfer payloads
Baseline expected firmware versions and alert on deviations across the fleet
Inspect device management logs for update events that lack a corresponding authorized change record

Monitoring Recommendations

Centralize charging station telemetry and update event logs in a SIEM for correlation across the fleet
Alert on repeated update attempts, especially from sources outside the vendor's authorized update infrastructure
Track firmware hash and version inventory continuously to detect rogue installations

How to Mitigate CVE-2026-9397

Immediate Actions Required

Restrict network access to BS20 charging stations using network segmentation and firewall rules that permit only authorized OTA sources
Disable remote OTA functionality where operationally feasible until a vendor patch is available
Inventory all deployed BS20 units and confirm firmware versions against vendor records
Monitor for vendor advisories from Besen, who acknowledged the report in April 2026

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry. Besen acknowledged receipt of the disclosure and indicated the issue was under review as of April 2026. Operators should track the VulDB #365378 entry and vendor communications for patch availability.

Workarounds

Place charging stations behind a network gateway that filters OTA traffic to only vendor-authorized endpoints
Implement strict allow-listing of management IP addresses permitted to communicate with the update handler
Apply VLAN isolation to separate EV charging infrastructure from general enterprise and public networks
Conduct periodic firmware integrity audits across the deployed fleet

bash

# Example firewall allow-list restricting OTA traffic to vendor sources
# Replace VENDOR_OTA_IP with the authorized Besen update server address
iptables -A INPUT -p tcp --dport 443 -s VENDOR_OTA_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A OUTPUT -p tcp --dport 443 -d VENDOR_OTA_IP -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j DROP