CVE-2026-9394 | Besen BS20 EV Charging Station up to 20260426 Bluetooth Low Energy weak password

A vulnerability, which was classified as problematic, was found in Besen BS20 EV Charging Station up to 20260426. This impacts an unknown function of the component Bluetooth Low Energy Handler. Executing a manipulation can lead to weak password requirements.

The identification of this vulnerability is CVE-2026-9394. The attack needs to be done within the local network. Furthermore, there is an exploit available.

The original disclosure mentions, that “[t]hese vulnerabilities have been reported to Besen and we have received their acknowlegement that they are reviewing this as of April 2026.”