Besen BS20 EV Charging Station Firmware Version Check ui layer

Vulnerability

The Besen BS20 Home EV Charging Station (firmware versions up to 20260426) contains a UI-spoofing vulnerability in the Firmware Version Check functionality of the mobile app. When the app checks for a new firmware version, it does not validate the response from the server. An attacker can intercept and modify the response to report an arbitrary, higher version number, causing the app to display a “New firmware available” prompt and enable the upgrade button even when the device is already up to date [1].

Exploitation

The attack requires the attacker to be on the same local network as the charging station (or to have compromised a network intermediary) to intercept the version-check communication. High complexity is associated with this attack because of the need to reliably position and execute man-in-the-middle (MITM) interception. The attacker must spoof a version response that is greater than the current installed version; the app does not perform any cryptographic validation of the response before presenting the upgrade prompt to the user [1].

Impact

Successful exploitation leads to UI spoofing: the user is shown a misleading “newer firmware” notification and a clickable upgrade button, even though no genuine update exists. While the vulnerability alone does not directly install malicious firmware, it undermines user trust and can be used as a precursor to social engineering attacks. It could also be combined with other OTA-related weaknesses (e.g., incomplete firmware validation, reported as CVE-2026-9397) to induce a user to install a tampered firmware image [1].

Mitigation

As of the publication date (May 24, 2026), Besen has acknowledged the report and stated they are reviewing the vulnerability, but no fixed firmware version or patch has been released. Users should monitor the vendor’s support page for updates. As a workaround, network segmentation and monitoring of BLE/UDP traffic may help detect spoofed responses, but the most effective mitigation is a firmware update that enforces cryptographic validation of version-check responses. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog [1].