A vulnerability in the OTA Update Installation Handler of the Besen BS20 EV Charging Station allows attackers to bypass authentication controls, enabling them to install arbitrary firmware remotely. This improper authorization can potentially expose the vehicle charging infrastructure to unauthorized changes, resulting in a compromise of confidentiality, integrity, and availability.

Besen BS20 EV Charging Station models up to firmware version 20260426 are affected. The issue targets the OTA Update Installation Handler component and applies to any device running firmware prior to the fix. No other Besen products listed by the CNA are reported to be impacted.

The CVSS score of 9.2 indicates a high severity vulnerability. The EPSS score is not available, but the attack requires remote network access to the OTA service and a high level of complexity. Because the weakness lies in authorization, an attacker who can influence OTA update traffic could install malicious firmware, effectively achieving remote code execution on the charging station. The vulnerability is not listed in CISA KEV, yet any user of the affected models should assume that unauthorized firmware installation could be exploited if not corrected.