Besen BS20 EV Charging Station BLE/WiFi authentication replay

Vulnerability

The Besen BS20 EV Charging Station (firmware versions up to 20260426) exposes an authentication bypass via capture-replay on its BLE and WiFi interfaces [1]. The device does not implement replay protection, allowing an attacker to record valid authentication exchanges and reuse them to impersonate a legitimate user. The affected component is unspecified but involves both BLE and WiFi communication channels.

Exploitation

An attacker must be on the same local network as the charging station to capture the authentication handshake. The attack is described as highly complex, likely due to the need to synchronize with the short-lived authentication window and the requirement to capture traffic without triggering alarms. Once captured, the recorded packet can be replayed to bypass authentication without knowledge of the actual credentials.

Impact

Successful exploitation grants full unauthorized access to the charging station's control interface. An attacker can modify charging parameters, initiate or stop charging sessions, and potentially disrupt the EV charging service. The authentication bypass undermines all security controls that rely on proper user identification.

Mitigation

As of the publication date (2026-05-24), Besen has acknowledged the report and is reviewing the issue [1]. No official patch or firmware update has been released. Users should isolate the charging station on a separate, secure network segment and monitor the vendor's advisory channels for future fixes. The vulnerability affects all versions up to 20260426.