Besen BS20 EV Charging Station BLE and UDP Credential Exposure Vulnerability

A vulnerability exists in the Besen BS20 EV Charging Station, affecting versions through April 26, 2026. The issue arises from an unknown function in the BLE/UDP component, leading to the exposure of user credentials in plaintext. This vulnerability requires local network access to exploit. Operations such as password changes reveal both old and new passwords in cleartext, and the plaintext passwords are frequently broadcasted via UDP, making them accessible to any attacker on the same local network.

Impact

Successful exploitation allows unauthorized access and control of the charging station.