Monta App EUVD-2026-91820

No authentication, privileges, or user interaction are required (PR:N/UI:N): the authentication identifiers are exposed through publicly accessible web-based mapping platforms, so any remote party able to reach those maps can retrieve them against Monta's deployed charging stations. The primary limiting factor is scope of impact rather than access difficulty - the identifiers are a disclosure (C:L) that enables follow-on misuse rather than granting direct station or account control; realistic harm depends on how Monta's backend trusts these identifiers, which is not fully specified in the advisory. No non-default configuration is stated as required; EUVD lists all versions of monta.app as affected.

This is a credential-exposure issue (CWE-522) rated CVSS 6.5 with vector AV:N/AC:L/PR:N/UI:N (network, low complexity, no privileges, no user interaction), meaning the authentication identifiers are reachable by any remote, unauthenticated party simply by browsing the web-based mapping platforms described. The low technical barrier is the main driver of concern. However, the mitigating signals are significant: no EPSS score was provided in the input, the CVE is NOT on the CISA KEV list (no confirmed active exploitation), and no public exploit code is referenced - only the official CISA ICS advisory and its CSAF JSON. The confidentiality and integrity impacts are both scored LOW, consistent with disclosure of identifiers rather than full account takeover or station control, so this reads as a genuine-but-moderate exposure rather than a top-tier emergency. One point to verify with the vendor: the practical consequence of an exposed 'authentication identifier' is ambiguous - if those identifiers alone permit charging-session abuse or impersonation, real impact could exceed the LOW/LOW scoring; if they are merely enumerable references, impact is lower. EPSS is absent and should be pulled to refine exploitation likelihood.

A remote, unauthenticated attacker browses the publicly accessible web-based EV charging maps exposing Monta station authentication identifiers and harvests them at scale with simple scripted requests. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, special access, or victim interaction are needed. No public proof-of-concept is referenced, but harvesting is trivial and the identifiers could then be abused for unauthorized charging-session actions or user enumeration depending on how the platform consumes them.