Monta monta.app: 4 CVEs, Critical 9.4
Summary
CISA reports 4 vulnerabilities in Monta monta.app. Weakness types: Missing Authentication for Critical Function, Improper Restriction of Excessive Authentication Attempts, Insufficient Session Expiration (+1 more). Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks. Highest CVSS v3 score: 9.4 (Critical), exploitable over the network.
At a glance
- Vendor
- Monta
- Products
- monta.app
- CVEs
- CVE-2026-95102, CVE-2026-97363, CVE-2026-97212, CVE-2026-93474
- Highest CVSS v3
- 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Energy, Transportation Systems
- Deployed
- Worldwide
- Vendor HQ
- Netherlands
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-95102 | Missing Authentication for Critical Function | 9.4 | – | No | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to privilege escalation and potentially compromise the security of the entire system. |
| CVE-2026-97363 | Improper Restriction of Excessive Authentication Attempts | 7.5 | – | No | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access. |
| CVE-2026-97212 | Insufficient Session Expiration | 7.3 | – | No | The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend… |
| CVE-2026-93474 | Insufficiently Protected Credentials | 6.5 | – | No | Charging station authentication identifiers are publicly accessible via web-based mapping platforms. |
Affected products (1)
- Monta monta.app: vers:all/*
Vendor fixes and mitigations (from advisory)
- Mitigation: Monta states that they are actively working to increase adoption of authenticated connections across their network and to deprecate unauthenticated access on a rolling basis. Monta states that they provide support for OCPP 1.6 Security Profile 2 (HTTP Basic Auth with TLS) and encourage operators to enable it.
- Mitigation: Monta states that they have implemented rate limiting and automated connection throttling at the WebSocket layer. Connections exhibiting abusive patterns, including rapid reconnection, ID brute-forcing behavior, or excessive command volume, are automatically identified and blocked.
- Mitigation: Monta states that their platform handles duplicate connection attempts per the OCPP specification, where a new authenticated connection supersedes an existing session for the same station ID.
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.