Vulnerability · Published May 24, 2026 · Assigned by VulDB

CVE-2026-9395Besen BS20 EV Charging Station BLE/UDP insufficiently protected credentials

Low 3.5

In plain English

A low-severity security flaw in BS20 EV Charging Station from Besen. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.2%top 95.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in Besen BS20 EV Charging Station up to 20260426. Affected is an unknown function of the component BLE/UDP. The manipulation leads to insufficiently protected credentials. The attack needs to be initiated within the local network. The original disclosure mentions, that "[t]hese vulnerabilities have been reported to Besen and we have received their acknowlegement that they are reviewing this as of April 2026."

Affected products (as reported)

Vendor	Product	Versions
Besen	BS20 EV Charging Station	20260426

Weakness: CWE-522 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References

VDB-365376 | Besen BS20 EV Charging Station BLE/UDP insufficiently protected credentials vdb-entry
VDB-365376 | CTI Indicators (IOB, IOC, TTP) signature, permissions-required
Submit #813572 | Besen EV Charging Station BS20 EV Charger Insufficiently Protected Credentials third-party-advisory
https://github.com/carfeii/besen#finding-2-cleartext-credential-exposure-via-ble-and-udp-in-besen-home-ev-charging-station related