EUVD-2026-91824
GHSA-jr23-ffqr-cj5j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed WebSocket endpoint
-
DeliveryConnect without authentication
-
ExploitImpersonate legitimate charging station
-
ExecutionIssue unauthorized backend commands
-
ImpactExfiltrate data and escalate privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Monta platform's WebSocket (OCPP-style charging-station) endpoints, which by design accept charging-station connections but - per the advisory - enforce no authentication, so any attacker able to reach the endpoint can impersonate a station against default/all versions. The primary limiting factor is network exposure: endpoints restricted to private networks, VPNs, or allowlisted charger IPs substantially reduce reachability. No user interaction, credentials, or non-default configuration are needed (PR:N/UI:N/AC:L), and all versions are reported affected, so there is no version-based mitigation absent a vendor fix. |
| Impact | This is a genuine high-priority issue for organizations running the Monta EV-charging platform. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity exploitation requiring no privileges and no user interaction, mapping directly to the CWE-306 (Missing Authentication) root cause: unauthenticated WebSocket endpoints that allow charging-station impersonation. Vulnerable-system impacts are high for confidentiality and integrity and low for availability (VC:H/VI:H/VA:L), consistent with unauthorized data access and unauthorized actions rather than full service takedown. The 9.3 'Critical' score is well-supported by the vector rather than inflated. However, several exploitation signals are absent: no EPSS probability, no CISA KEV listing, and no public POC are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The reporting through ICS-CERT (icscert) and a CISA ICS advisory indicates vendor-coordinated disclosure and raises defensive urgency, but exploitation likelihood cannot be quantified from the data given. Net: treat as a real priority for Monta operators due to easy unauthenticated network exploitation, while recognizing exploitation-in-the-wild is unconfirmed. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker connects to an exposed Monta WebSocket endpoint and, because no authentication is enforced, impersonates a legitimate charging station to the backend. From that trusted position they read sensitive session/telemetry data and issue unauthorized commands, escalating privileges within the charging-management system. No public proof-of-concept is identified in the provided data, and the low attack complexity (AC:L) means no special timing or conditions are needed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 02, 2026
Unauthenticated WebSocket endpoints in the Monta EV charging platform (monta.app, all versions) allow any network-reachable attacker to impersonate a charging station and thereby read sensitive backend data or perform unauthorized actions on the platform. The weakness is a missing-authentication flaw (CWE-306) rated 9.3 under CVSS 4.0 and mapped by the independent assessment to CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact and low availability impact, meaning unauthenticated remote attackers need no credentials, user interaction, or non-default configuration - network reachability to the charging-station WebSocket service is the only practical prerequisite. There is no public exploit identified at time of analysis and no KEV listing, but ICS-CERT has published an advisory covering all versions, and the absence of a version-based mitigation makes exposure reduction the primary interim control.
Earlier versions of this analysis (1)
Unauthenticated WebSocket endpoints in Monta App (monta.app) let remote attackers impersonate legitimate EV charging stations and interact with the backend without presenting any credentials, enabling unauthorized data access, unauthorized actions, and privilege escalation into the broader charging platform. The flaw affects all versions of the product (CWE-306, missing authentication for a critical function) and is rated CVSS 9.4 with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, meaning no authentication, privileges, or user interaction are required - only network reachability to the exposed WebSocket service. Per available intelligence, no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the practical risk therefore concentrates on deployments whose WebSocket endpoints are internet- or broadly network-exposed, which are directly exploitable.
RemediationAI
No vendor-released patch identified at time of analysis, so remediation must start with exposure reduction: restrict the charging-station WebSocket endpoints so only legitimate charge-point networks can reach them, by placing the listener behind a VPN or private network segment, applying IP allowlisting for known charger egress addresses, or fronting it with a reverse proxy/load balancer that enforces mutual TLS client certificates - with the trade-off that IP allowlisting breaks for chargers on dynamic or CGNAT mobile links and mTLS requires provisioning and rotating certificates on every station. Where the endpoints must remain internet-facing, terminate them through a gateway that performs authentication on the WebSocket handshake and rejects connections presenting no or unknown station identity, accepting the operational cost of maintaining that gateway as an added component in the charging path. As compensating detective controls, log and alert on WebSocket connections originating from unexpected source addresses, on duplicate or conflicting charge-point identities, and on anomalous transaction/status messages from stations that are simultaneously connected elsewhere - these do not prevent impersonation but shorten the window between abuse and detection. Network segmentation should keep the station-facing endpoint away from management, payment, and customer-data APIs so that a successful impersonation cannot pivot laterally, and any credentials or customer data reachable through the endpoint should be rotated or reviewed once compromise is suspected. Monitor the ICS-CERT advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-02 (CSAF: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-02.json) and the EUVD entry EUVD-2026-91824 for a vendor fix, and apply it as soon as a fixed build is published, since every currently reported version is affected and no configuration-only hardening fully substitutes for endpoint authentication.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the WebSocket-based charging-station interface of the Monta EV-charging management platform (CPE cpe:2.3:a:monta:monta.app:*:*:*:*:*:*:*:*), the class of endpoint typically used to carry OCPP-style charge-point-to-central-system traffic. In a correctly hardened deployment, such endpoints establish the identity of the connecting charge point - for example via a station identifier plus credentials or client certificates during the WebSocket handshake - before the backend acts on any message. CWE-306 (Missing Authentication for Critical Function) describes exactly the failure here: the endpoints accept station connections and process their messages without enforcing any authentication at all. Because the protocol is bidirectional and stateful, an attacker who can open a WebSocket to the endpoint inherits the trust the backend extends to a legitimate charge point, which is why the assessed impact spans both confidentiality and integrity (C:H/I:H) rather than being limited to information disclosure. The published CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:L, no subsequent-system impact in the assessed baseline) and the independent CVSS 3.1 assessment (S:U, C:H/I:H/A:L) agree that the vulnerability is remotely reachable and unauthenticated; neither indicates a scope change beyond the Monta platform itself. The ICS-CERT advisory and its accompanying CSAF document (ICSA-26-274-02) are the authoritative sources, and the EUVD entry (EUVD-2026-91824) confirms that all versions of monta.app are affected rather than a bounded version range.
Know when Monta App gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Unauthenticated network WebSocket with no user interaction gives AV:N/AC:L/PR:N/UI:N; impersonation yields high confidentiality/integrity impact and limited availability impact (A:L), scope unchanged.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
3DescriptionCVE.org
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to privilege escalation and potentially compromise the security of the entire system.
Executive ViewAI
The Monta EV charging platform (all versions) contains a critical unauthenticated WebSocket endpoint vulnerability (CVE-2026-95102) that allows any network-reachable attacker to impersonate charging stations, read sensitive backend data, and perform unauthorized actions. This flaw affects the confidentiality and integrity of the entire platform, potentially disrupting EV charging services and exposing customer information. Leadership should prioritize immediate exposure reduction and monitor for exploitation, as no vendor patch is currently available.
No vendor-released patch identified at time of analysis; interim mitigations focus on exposure reduction: restrict network reachability to the charging-station WebSocket service, implement network segmentation, enable monitoring for unauthorized station impersonation, and coordinate with Monta and ICS-CERT for updated guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Missing rate limiting on the Monta EV-charging platform's WebSocket API authentication endpoint allows unauthenticated r
Unauthenticated session prediction in Monta App's WebSocket backend permits remote attackers to impersonate other chargi
Authentication identifiers for Monta-managed charging stations are published on publicly accessible web-based mapping pl
Exploit-DB