Besen BS20 CVE-2026-9398

The attacker must be within BLE or WiFi radio range of the targeted BS20 charger - this is an adjacent-network attack (AV:A), not remotely exploitable over the internet. The high attack complexity (AC:H) requires the attacker to successfully capture a valid authentication token in transit before it expires, implying a time-sensitive passive interception phase. The vulnerability is specifically conditioned on the BS20's BLE and/or WiFi interface being active and in use; if both wireless interfaces are disabled, the attack surface is eliminated. No authentication is required from the attacker (PR:N), and no user interaction is needed (UI:N). Exploitation is limited to integrity tampering of charger commands (VI:L) - the attacker cannot read configuration data or credentials (VC:N) and cannot crash the device (VA:N). The high complexity requirement and local adjacency constraint are the primary factors limiting real-world exploitation to motivated, technically capable adversaries with physical site access.

The overall risk is low despite the authentication bypass classification. The CVSS 4.0 score of 1.3 reflects several constraining factors: AV:A requires physical adjacency to the target's BLE/WiFi broadcast range, AC:H indicates high attack complexity (requiring successful traffic capture and replay before session expiry), and the maximum impact is limited to VI:L (low integrity on the vulnerable component only) with no confidentiality or availability impact. The EPSS score of 0.03% at the 11th percentile corroborates this low exploitation likelihood - very few systems in this category see active opportunistic exploitation. The CVE is NOT listed in the CISA KEV catalog, meaning no confirmed active exploitation has been observed. However, the CVSS Exploit Maturity metric E:P confirms a proof-of-concept exists (corroborated by a public GitHub repository documenting 'Finding 5: Unauthorized Tampering of Charger Commands'). The IoT physical context adds nuance: while data impact scores are low, unauthorized charger command manipulation in an EV fleet or commercial charging environment could translate to operational disruption or billing fraud not captured by the CVSS vector. The high complexity rating is consistent with the vendor's own characterization that 'exploitability is difficult.'

An attacker in physical proximity to a Besen BS20 charger - such as in a parking facility or commercial EV charging site - passively monitors BLE or WiFi traffic using a software-defined radio or standard wireless adapter. When a legitimate user or management system authenticates to issue a charging command, the attacker captures the authentication token and immediately or shortly thereafter replays it to issue their own commands, such as stopping an active charging session or modifying charge parameters. A public proof-of-concept documenting this technique as 'Finding 5: Unauthorized Tampering of Charger Commands' is available on GitHub, which provides technical detail sufficient to reproduce the attack.