Besen BS20 EUVD-2026-31548

The attacker must be physically within Bluetooth Low Energy radio range of a deployed Besen BS20 unit - typically 10 to 100 meters depending on environment and antenna characteristics (CVSS AV:A, adjacent network). High attack complexity (AC:H) means exploitation is not straightforward: the attacker likely requires familiarity with BLE GATT protocol, the specific service/characteristic layout of the BS20 firmware, and the ability to conduct iterative brute-force or enumeration attempts. No privileges are required on the target device prior to exploitation (PR:N), and no user interaction is needed (UI:N). Exploitation is limited to firmware versions up to 20260426; later firmware, if and when released, may address the issue. Exploitation impact is bounded to low confidentiality disclosure (VC:L) - no integrity or availability impact is confirmed. The physical proximity requirement is the primary limiting factor that reduces real-world exploitation probability significantly beyond what unauthenticated network-reachable vulnerabilities present.

The aggregate risk signal is low. The CVSS 4.0 base score of 1.3 reflects physical proximity constraints (AV:A), high attack complexity (AC:H), and a ceiling of low confidentiality impact with no integrity or availability consequence - an attacker who succeeds gains read-level access to some credential or data, not control over charging operations per the reported scope. EPSS at 0.01% (2nd percentile) is consistent with a highly targeted, niche IoT device with limited deployment footprint, and the vulnerability is absent from CISA KEV confirming no observed mass exploitation. However, publicly available exploit code (E:P, GitHub PoC) is a meaningful escalation signal over theoretical vulnerabilities, reducing the barrier for opportunistic actors near deployed units. The 'Brute Force' and 'Information Disclosure' tags align with the realistic threat model: an attacker in a parking garage or home driveway could enumerate BLE credentials. For EV charging infrastructure in shared or public environments, this is a more credible threat scenario than the raw score implies. No SSVC data is available; exploitation status should be rated 'PoC' rather than 'active'. The primary limiting factor is physical proximity - this cannot be exploited remotely over the internet.

An attacker parks within Bluetooth Low Energy range of a Besen BS20 charger - such as in a shared driveway, apartment parking structure, or public charging area - and uses the publicly available proof-of-concept code (https://github.com/carfeii/besen) to enumerate BLE GATT services and attempt brute-force credential guessing against the BLE authentication handler. Due to weak password requirements enforced by the firmware, the attacker successfully recovers or bypasses the credential, gaining read-level access to device data or configuration exposed over BLE. High attack complexity (AC:H) means success is not guaranteed on first attempt and likely requires knowledge of BLE service structure and precise interaction sequencing.