Monta App EUVD-2026-91821

Exploitation requires the attacker to reach Monta's WebSocket backend endpoint over the network and to supply a charging-station identifier that the backend uses as the session identifier; because these identifiers are predictable and the backend permits multiple endpoints to connect under the same identifier, no credentials are needed (PR:N, no user interaction). The practical prerequisite is knowledge of the valid charging-station identifier format/namespace, which the predictability of the identifiers makes feasible through guessing or enumeration. Limiting factors: the attacker must have network access to the specific Monta backend (an internet-facing cloud/OT service), and impacts are partial (Low) - session impersonation yields limited confidentiality/integrity rather than full account control, and the DoS requires generating enough valid session requests to overwhelm the backend.

The CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) describes a network-reachable, low-complexity, unauthenticated flaw with limited impact across all three dimensions - consistent with the description's dual outcome of impersonation (authenticating as other users) and denial of service. This is a session-management weakness (CWE-613): the WebSocket backend derives session identity from charging-station identifiers that are both predictable and permitted to be reused across multiple concurrent endpoints. No EPSS score, KEV listing, POC, or SSVC decision data was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk rating therefore rests on the CVSS vector and description alone, not on observed threat activity. The signals are internally consistent (network vector matches a WebSocket cloud backend; low privileges match PR:N), so this reads as a genuine moderate-priority issue rather than an inflated high-CVSS score - but note the impacts are all rated Low, meaning successful attacks yield partial account impersonation and service degradation rather than full compromise. Because exploitation probability data (EPSS) is entirely absent, prioritization should lean on exposure: an internet-facing OT/EV-charging cloud backend reachable by unauthenticated attackers warrants timely patching.

An unauthenticated attacker connects to Monta's internet-facing WebSocket backend and supplies a predictable charging-station identifier, which the backend accepts as a session identifier even though another endpoint is already using it. By guessing or enumerating valid station IDs, the attacker can hijack or impersonate another user's session, or open large numbers of valid session requests to overwhelm and deny service to the backend. No public exploit code was identified at time of analysis.