PT-2026-42967 · Besen · Bs20 Ev Charging Station

Carfeii · Published 2026-05-24 · Updated 2026-05-24 · CVE-2026-9397

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Besen BS20 EV Charging Station versions prior to 20260426

Description An improper authorization issue exists in the OTA Update Installation Handler component. This flaw allows a remote attacker to perform unauthorized manipulations, although the attack requires a high degree of complexity and is difficult to exploit.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2026-9397

Affected Products

Bs20 Ev Charging Station

References · 6

• https://github.com/carfeii/besen#finding-4-unauthorized-firmware-installation-via-spoofed-ota-updates · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-9397 · Security Note
• https://vuldb.com/vuln/365378 · Note
• https://t.me/CVEtracker/54790 · Telegram Post
• https://vuldb.com/submit/813576 · Note
• https://vuldb.com/vuln/365378/cti · Note