Besen BS20 CVE-2026-9394

Q: What is the CVSS score of CVE-2026-9394?

CVE-2026-9394 has a CVSS 4.0 base score of 1.3 (Low). CVSS vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31548 LOW

Weak Password Requirements (CWE-521)

2026-05-24 VulDB

GHSA-fj8p-hqwr-45hx

Information Disclosure Brute Force Bs20 Ev Charging Station

1.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.3 LOW

CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:08 vuln.today

CVSS changed

May 26, 2026 - 20:07 NVD

3.1 (LOW) 1.3 (LOW)

DescriptionCVE.org

A vulnerability was determined in Besen BS20 EV Charging Station up to 20260426. This impacts an unknown function of the component Bluetooth Low Energy Handler. Executing a manipulation can lead to weak password requirements. The attack needs to be done within the local network. This attack is characterized by high complexity. The exploitability is said to be difficult. The original disclosure mentions, that "[t]hese vulnerabilities have been reported to Besen and we have received their acknowlegement that they are reviewing this as of April 2026."

AnalysisAI

Weak password requirements in the Bluetooth Low Energy (BLE) handler of the Besen BS20 EV Charging Station (firmware up to 20260426) expose the device to credential brute-forcing from adjacent-network attackers within Bluetooth range. The flaw, catalogued under CWE-521, results in limited confidentiality impact (VC:L in CVSS 4.0) with no integrity or availability consequences, yielding an overall CVSS 4.0 score of 1.3. Publicly available exploit code exists (E:P in CVSS vector, GitHub PoC at carfeii/besen), though EPSS sits at 0.01% (2nd percentile), and no active exploitation has been confirmed by CISA KEV. Besen acknowledged the report as of April 2026 but no patched firmware version has been released.

Technical ContextAI

The affected component is the Bluetooth Low Energy (BLE) handler embedded in the Besen BS20 home EV charging station, identified by CPE cpe:2.3:a:besen:bs20_ev_charging_station:*:*:*:*:*:*:*:*. BLE is used as the primary local wireless interface for pairing, configuration, and potentially session authentication between the charger and a companion mobile app. CWE-521 (Weak Password Requirements) indicates the firmware does not enforce sufficient password strength, length, or complexity constraints on BLE-authenticated interactions, making credentials susceptible to enumeration or brute-force within radio range. The adjacent-network attack vector (AV:A) in CVSS 4.0 bounds exploitation to Bluetooth proximity (typically 10-100 meters), distinguishing this from internet-reachable vulnerabilities. The high attack complexity (AC:H) likely reflects the need to interact with specific BLE GATT services or characteristic handles and possibly to perform precise timing or sequencing of BLE operations.

RemediationAI

No vendor-released patch has been identified at time of analysis - Besen acknowledged the report as of April 2026 and stated they are reviewing the findings, but no fixed firmware version has been confirmed by NVD, ENISA EUVD, or the researcher's disclosure at https://github.com/carfeii/besen. Until a firmware update is available, defenders should apply the following compensating controls: restrict physical access to the charging station and its Bluetooth radio range, particularly in shared or semi-public environments where unauthorized individuals could approach within BLE proximity (10-100 meters); change any default or factory-set BLE credentials to strong, unique passphrases where the device interface permits, to raise the brute-force cost despite the weak enforcement policy; monitor companion mobile app logs or network traffic for anomalous BLE pairing attempts; and consider disabling BLE functionality entirely if the charger can be managed via an alternative interface, accepting the trade-off of losing remote mobile-app control. Customers should monitor the Besen vendor channel and VulDB entry https://vuldb.com/vuln/365375 for firmware update announcements.