CVE-2026-9397 | Besen BS20 EV Charging Station up to 20260426 OTA Update Installation improper authorization

A vulnerability was found in Besen BS20 EV Charging Station up to 20260426. It has been classified as critical. Affected by this issue is some unknown functionality of the component OTA Update Installation Handler. This manipulation causes improper authorization.

This vulnerability is tracked as CVE-2026-9397. The attack is possible to be carried out remotely. Moreover, an exploit is present.

The original disclosure mentions, that “[t]hese vulnerabilities have been reported to Besen and we have received their acknowlegement that they are reviewing this as of April 2026.”