CVE-2026-9398: Besen BS20 EV Auth Bypass Vulnerability

CVE-2026-9398 Overview

CVE-2026-9398 is an authentication bypass by capture-replay vulnerability affecting Besen BS20 EV Charging Station builds up to 20260426. The flaw resides in the Bluetooth Low Energy (BLE) and WiFi communication component used to issue charger commands. An attacker on the adjacent local network can capture legitimate command traffic and replay it to manipulate the charging station without valid authentication. The original disclosure notes the issue has been reported to Besen, with vendor acknowledgement of review as of April 2026. The vulnerability is classified under CWE-287: Improper Authentication.

Critical Impact
An adjacent-network attacker can replay captured BLE or WiFi commands to tamper with charger operations, bypassing authentication on Besen BS20 EV Charging Stations up to build 20260426.

Affected Products

Besen BS20 EV Charging Station (firmware/build up to 20260426)
BLE communication component of the BS20 charger
WiFi communication component of the BS20 charger

Discovery Timeline

April 2026 - Vulnerability reported to Besen; vendor acknowledged review of the findings
2026-05-24 - CVE-2026-9398 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9398

Vulnerability Analysis

The BS20 charger accepts BLE and WiFi command messages without verifying message freshness or origin. Because the protocol lacks anti-replay protection such as nonces, sequence counters, or time-bound tokens, previously captured authenticated commands remain valid when re-transmitted. An attacker within BLE or WiFi range can sniff a legitimate session and re-issue the same packets to control charger state.

Exploitation is constrained to the local radio range and requires the attacker to first observe valid command traffic. The disclosure indicates the attack complexity is high and exploitability is difficult. Successful replay leads to unauthorized tampering with charger commands rather than full code execution or data theft. The integrity impact is limited, and confidentiality and availability are not directly affected by the replay action itself.

Root Cause

The root cause is the absence of a challenge-response or freshness mechanism in the BLE/WiFi command protocol used by the BS20. Authentication material, if present, is bound to the message rather than to a session-unique value, allowing identical packets to authenticate successfully on each replay. This matches the CWE-287 pattern of authentication bypass by capture-replay.

Attack Vector

The attack requires adjacent network access. An attacker positions within BLE range or on the same WiFi segment as the charger and the controlling mobile app. The attacker captures command frames during a normal user session using standard wireless sniffing tools. The captured frames are then retransmitted toward the charger to trigger the original command. Technical details of the command structure are documented in the GitHub research write-up by carfeii.

No verified public exploit code is referenced beyond the research notes. Refer to the VulDB entry #365379 for additional metadata.

Detection Methods for CVE-2026-9398

Indicators of Compromise

Duplicate BLE or WiFi command frames observed on the local segment with identical payloads and authentication fields within a short time window.
Charger state transitions (start, stop, configuration change) that do not correlate with a user action in the official mobile app logs.
Unexpected BLE advertisement scanning or pairing attempts in proximity to the charger.

Detection Strategies

Monitor wireless segments hosting EV chargers for repeated identical packets that indicate replay rather than fresh session traffic.
Correlate charger command logs with authenticated user activity from the management application to identify commands without a matching user session.
Use BLE-aware monitoring tools to flag command frames originating from a MAC address that was not part of an active pairing session.

Monitoring Recommendations

Capture and retain charger network telemetry centrally so that replay patterns can be reviewed retrospectively.
Alert on charger commands issued outside of expected operating hours or from unexpected client identifiers.
Track firmware build strings reported by deployed BS20 units to confirm whether each device is still on a vulnerable build at or below 20260426.

How to Mitigate CVE-2026-9398

Immediate Actions Required

Restrict physical and radio access to the charger so that untrusted devices cannot reach its BLE or WiFi interfaces.
Place the charger on an isolated WiFi SSID or VLAN segregated from guest, corporate, and IoT networks.
Disable BLE control when not actively needed for provisioning or maintenance.
Inventory all BS20 units and record current firmware build to prioritize remediation once Besen issues a fix.

Patch Information

As of the NVD publication date, Besen has acknowledged the report and is reviewing the issue, but no vendor patch identifier is referenced in the advisory. Operators should monitor Besen support channels for an updated firmware build superseding 20260426. Track status through the VulDB vulnerability record #365379 and the original research disclosure.

Workarounds

Operate the charger only on a WPA2/WPA3-Enterprise WiFi network with client isolation enabled to limit who can observe and inject traffic.
Reduce BLE transmit power or shield the device location to shrink the practical attack radius.
Pair the charger only in controlled environments and unpair unused mobile clients to minimize the number of valid sessions an attacker could capture.

bash

# Example: isolate the charger on a dedicated VLAN and block lateral traffic
# (adjust interface and subnet to match the deployment)
vconfig add eth0 42
ip addr add 192.0.2.1/29 dev eth0.42
iptables -A FORWARD -i eth0.42 -o eth0.42 -j DROP
iptables -A FORWARD -i eth0.42 -d 192.0.2.0/29 -j ACCEPT