PatchSiren cyber security CVE debrief
CVE-2026-9395 Besen CVE debrief
A vulnerability in Besen BS20 EV Charging Station firmware up to 20260426 exposes insufficiently protected credentials via Bluetooth Low Energy (BLE) and UDP protocols. The issue, classified as CWE-522 (Insufficiently Protected Credentials), allows an attacker on the local network to obtain cleartext credentials. The CVSS 4.0 score of 2.0 (LOW severity) reflects the attack vector requirement of adjacent network access and low impact on confidentiality. The vulnerability was disclosed to Besen in April 2026 with vendor acknowledgment of ongoing review. No known exploitation in the wild or ransomware campaign use has been reported.
- Vendor
- Besen
- Product
- BS20 EV Charging Station
- CVSS
- LOW 2
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-24
- Original CVE updated
- 2026-05-26
- Advisory published
- 2026-05-24
- Advisory updated
- 2026-05-26
Who should care
Owners and operators of Besen BS20 EV charging stations, facilities management securing EV infrastructure, OT security teams protecting charging networks, and organizations with Bring Your Own Charger (BYOC) policies
Technical summary
The Besen BS20 EV Charging Station transmits or stores credentials without adequate protection when handling BLE and UDP communications. An attacker with adjacent network access can intercept these credentials in cleartext. The vulnerability affects firmware versions through 20260426. Attack complexity is low, requiring no user interaction, but privileges are limited and impact is restricted to low confidentiality loss with no integrity or availability impact.
Defensive priority
low
Recommended defensive actions
- Segment EV charging station networks from critical infrastructure and user devices to contain potential credential exposure
- Monitor for unauthorized BLE scanning or UDP traffic targeting Besen BS20 devices on local networks
- Apply firmware updates from Besen when available; verify patch addresses credential protection in BLE/UDP handlers
- Review and rotate any credentials that may have been transmitted via affected devices
- Conduct network traffic analysis to detect cleartext credential transmission from charging stations
Evidence notes
Vulnerability disclosed via GitHub security research repository and indexed by VulDB. Vendor acknowledgment confirmed in disclosure. NVD status marked as 'Deferred' as of 2026-05-26.
Official resources
2026-04-26