Monta App CVE-2026-97363

The required condition is network reachability to the Monta WebSocket Application Programming Interface's authentication endpoint, which by design handles login requests; exploitation does not need special configuration because the flaw is the absence of any request-rate limiting on that interface (matching AV:N/AC:L/PR:N/UI:N). What LIMITS real impact: the denial-of-service path depends on the attacker generating sufficient request volume to exhaust capacity, while the brute-force-to-unauthorized-access path additionally depends on accounts having weak, guessable, or non-MFA-protected credentials - strong passwords or MFA materially blunt the credential-compromise outcome even though the missing rate limit remains.

This is a CVSS 4.0 8.7 (High) flaw in the Monta EV-charging platform's WebSocket API, reported through CISA ICS-CERT (icscert), stemming from CWE-307 (missing rate limiting on authentication requests). The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates remote, low-complexity, unauthenticated exploitation, but notably scopes impact to availability only (VA:H; VC:N/VI:N/VA... C and I none), meaning the official scoring treats this primarily as a denial-of-service issue rather than a credential-compromise issue. This CONFLICTS with the description, which explicitly states the missing rate limiting 'may allow an attacker to conduct denial-of-service attacks OR brute-force attacks to gain unauthorized access' - brute-force success would produce confidentiality/integrity impact that the provided vector does not capture. No EPSS score, KEV listing, or POC indicator is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the 8.7 is a capability-based score, not an exploitation-driven one. Realistically this is a genuine but secondary-tier priority: the network-reachable, unauthenticated, trivial-to-automate nature (brute force and request flooding are inherently scriptable) raises concern, but actual credential compromise depends on weak/guessable account passwords, and the absence of KEV/EPSS/POC signals suggests it is not currently under opportunistic mass exploitation. Patch availability is not stated in the input beyond the CISA/CSAF advisory references, which should be consulted for fixed versions.

A remote, unauthenticated attacker scripts a client against the Monta WebSocket authentication endpoint and submits a high-volume stream of login attempts. Because no rate limiting exists, they can either flood the endpoint to exhaust resources and deny service, or run a credential brute-force/password-spray campaign against known accounts to gain unauthorized access. No public exploit code is identified in the provided data, but the attack requires only standard WebSocket tooling given AV:N/AC:L/PR:N.