PT-2026-42967 · Besen · Bs20 Ev Charging Station

Carfeii · CVE-2026-9397 · Published 2026-05-24 · Updated 2026-05-24

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Besen BS20 EV Charging Station versions prior to 20260426

Description An improper authorization issue exists in the OTA Update Installation Handler component. This flaw allows a remote attacker to perform unauthorized manipulations, although the attack requires a high degree of complexity and is difficult to exploit.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Privilege Assignment

Improper Authorization

Weakness Enumeration

CWE-266

CWE-285

Related Identifiers

CVE-2026-9397

Affected Products

Bs20 Ev Charging Station

References · 6

• https://github.com/carfeii/besen#finding-4-unauthorized-firmware-installation-via-spoofed-ota-updates · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-9397 · Security Note
• https://vuldb.com/vuln/365378/cti · Note
• https://t.me/CVEtracker/54790 · Telegram Post
• https://vuldb.com/submit/813576 · Note
• https://vuldb.com/vuln/365378 · Note