Carfeii

**Name of the Vulnerable Software and Affected Versions** broot (affected versions not specified) **Description** broot renders file and directory names in its interactive tree view exactly as they are read from the filesystem without filtering control characters. This occurs during the conversion process using the `to string lossy()` call within `src/tree build/builder.rs` and the `TreeLine::unprune` function in `src/tree/tree line.rs`. A local user can create a file containing an escape sequence in its name, which is then written unmodified to the terminal of any user browsing that directory. This allows for the injection of OSC (Operating System Command) or CSI (Control Sequence Introducer) sequences, the impact of which depends on the terminal emulator being used. A proof of concept demonstrated the use of an OSC 52 sequence to write to the clipboard. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** powerlevel10k (affected versions not specified) **Description** The software fails to neutralize control characters within the `version` field of a `package.json` file when rendering the package prompt segment. This allows an attacker to inject raw escape bytes into the version string, which results in the emission of arbitrary terminal control sequences every time the shell enters a directory containing the malicious file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Besen BS20 EV Charging Station versions prior to 20260426 **Description** A security flaw exists in the Firmware Version Check component of the device. Remote manipulation of an unknown functionality within this component can lead to improper restriction of rendered UI layers. This attack is characterized by high complexity and is considered difficult to exploit. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Besen BS20 EV Charging Station versions prior to 20260426 **Description** An issue exists in the Bluetooth Low Energy Handler component where a manipulation can lead to weak password requirements. This attack requires local network access and is characterized by high complexity and difficult exploitability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Besen BS20 EV Charging Station versions prior to 20260426 **Description** A security issue exists in the BLE/WiFi component that allows for an authentication bypass via a capture-replay attack. This type of attack, where a valid transmission is recorded and later re-sent to deceive a system, requires the attacker to be within the local network. Exploitation is considered highly complex and difficult. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Besen BS20 EV Charging Station versions prior to 20260426 **Description** An improper authorization issue exists in the OTA Update Installation Handler component. This flaw allows a remote attacker to perform unauthorized manipulations, although the attack requires a high degree of complexity and is difficult to exploit. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Besen BS20 EV Charging Station versions prior to 20260426 **Description** An issue exists in the BLE/UDP component where an unknown function allows for the manipulation of insufficiently protected credentials. This attack must be initiated from within the local network. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.