Besen BS20 EV Charging Station BLE/WiFi Authentication Bypass Vulnerability

An authentication bypass vulnerability has been identified in the Besen BS20 EV Charging Station, affecting versions through 20260426. The vulnerability arises in the BLE/WiFi component, where an attacker can exploit capture-replay techniques to bypass authentication. This manipulation must be executed from within the local network, and while the original disclosure indicates that such attacks are highly complex, the vulnerability remains a significant concern.

Impact

Exploitation of this vulnerability allows for unauthorized manipulation of charging commands, including changes to duration, current, power, and start/stop states, all without authorization.