A vulnerability in the BLE/UDP component of the Besen BS20 EV Charging Station allows an attacker who is on the same local network to manipulate the system and read stored credentials without sufficient protection. The weakness corresponds to CWE-522, which means that credential handling is insecure, potentially exposing passwords or authentication tokens used by the device. The impact is limited to local credential disclosure, which could be used to gain further control over the charging station or impersonate legitimate users.

The vulnerability affects Besen BS20 EV Charging Station models shipped with firmware versions up to 20260426. No specific patch or version beyond this date is indicated in the data, so all devices up to and including this firmware release are considered vulnerable.

The CVSS base score of 5.1 indicates moderate risk, and the EPSS score is not available, suggesting no known widespread exploitation. The device is not listed in CISA KEV, so no confirmed exploit is published. The attack requires local network access, typically via BLE or UDP, so an adversary would need physical proximity or compromised local infrastructure to exploit it.