CVE-2026-9395 | Besen BS20 EV Charging Station up to 20260426 BLE/UDP insufficiently protected credentials

A vulnerability has been found in Besen BS20 EV Charging Station up to 20260426 and classified as problematic. Affected is an unknown function of the component BLE/UDP. The manipulation leads to insufficiently protected credentials.

This vulnerability is referenced as CVE-2026-9395. The attack needs to be initiated within the local network. Furthermore, an exploit is available.

The original disclosure mentions, that “[t]hese vulnerabilities have been reported to Besen and we have received their acknowlegement that they are reviewing this as of April 2026.”