Analyst readout for executives and security teams
Plain-English summary
A nearby or local attacker may face weaker password requirements in the BLE management path of a Besen BS20 EV charger. Published severity is low, with limited confidentiality impact and no stated integrity or availability impact. The business priority is inventory and vendor tracking, not emergency response, unless these chargers protect sensitive or safety-relevant sites.
Executive priority
Treat as a low-priority vulnerability management item. It warrants asset discovery, vendor follow-up, and local access controls, but the current evidence does not support emergency patching or incident response absent site-specific exposure concerns.
Technical view
CVE-2026-9394 affects an unknown function in the Bluetooth Low Energy Handler of Besen BS20 EV Charging Station up to 20260426. It maps to CWE-521 and CVSS 3.1 score 3.1, vector AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. The source describes difficult exploitability and high attack complexity.
Likely exposure
Exposure is limited to organizations operating Besen BS20 EV Charging Stations at the stated affected version/date level. The sources do not identify other Besen products, cloud services, or internet-reachable attack surface. Risk is most relevant where unauthorized people can get near the charger or access its local environment.
Exploitation context
No CISA KEV listing or cited source indicates active exploitation. The source describes exploitation as difficult, requiring local/adjacent access and high complexity. Public references include vulnerability details and a related researcher finding, but the supplied bundle does not establish real-world exploitation.
Researcher notes
Evidence is incomplete: the affected function is unnamed, and no patch is identified in the supplied sources. Besen reportedly acknowledged the report and was reviewing it as of April 2026. Avoid broad product assumptions beyond BS20 EV Charging Station up to 20260426.
Mitigation direction
- Inventory Besen BS20 EV Charging Stations and record firmware/version dates.
- Check Besen advisories for reviewed fixes or configuration guidance.
- Restrict physical and local access to charger management interfaces.
- Use strong, unique administrator credentials where configurable.
- Increase monitoring around chargers in sensitive sites until vendor guidance is available.
Validation and detection
- Confirm whether deployed chargers are Besen BS20 models.
- Compare firmware/version date against the affected 20260426 reference.
- Review BLE management exposure during authorized maintenance only.
- Check vendor or operator records for any firmware updates after April 2026.
- Document compensating controls for public or semi-public charging locations.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-521: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-9394 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 3.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
4 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R 1.6 1.4 VulDB CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R 1.6 1.4 VulDB CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P — — VulDB AV:A/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR 3.2 2.9 VulDB Vulnerability scoring details
Base CVSS 4.0 score
2.3 LowVector: CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Base CVSS 3.1 score
3.1 LowVector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
Base CVSS 3.0 score
3.1 LowVector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
Base CVSS 2.0 score
1.8 LowVector: AV:A/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timeline VulDB
Advisory disclosed
- Source timeline VulDB
VulDB entry created
- CVE reserved CVE Program
The CVE ID was reserved by the assigning CNA.
- Source timeline VulDB
VulDB entry last update
- CVE published CVE Program
The CVE record was published.
- CVE updated CVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 source CVE List V5
- VDB-365375 | Besen BS20 EV Charging Station Bluetooth Low Energy weak password CVE reference, VulDB · vdb-entry
- VDB-365375 | CTI Indicators (IOB, IOC, TTP) CVE reference, VulDB · signature, permissions-required
- Submit #813569 | Besen EV Charging Station BS20 EV Charger Weak Authentication CVE reference, VulDB · third-party-advisory
- https://github.com/carfeii/besen#finding-1-weak-authentication-mechanism-in-besen-home-ev-charging-station-via-ble CVE reference, VulDB · related
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Weak Password Requirements
Weak Password Requirements represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.