Monta App
Monthly
Unauthenticated WebSocket endpoints in the Monta EV charging platform (monta.app, all versions) allow any network-reachable attacker to impersonate a charging station and thereby read sensitive backend data or perform unauthorized actions on the platform. The weakness is a missing-authentication flaw (CWE-306) rated 9.3 under CVSS 4.0 and mapped by the independent assessment to CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact and low availability impact, meaning unauthenticated remote attackers need no credentials, user interaction, or non-default configuration - network reachability to the charging-station WebSocket service is the only practical prerequisite. There is no public exploit identified at time of analysis and no KEV listing, but ICS-CERT has published an advisory covering all versions, and the absence of a version-based mitigation makes exposure reduction the primary interim control.
Missing rate limiting on the Monta EV-charging platform's WebSocket API authentication endpoint allows unauthenticated remote attackers to send unlimited login requests, enabling either resource-exhaustion denial of service or sustained credential brute-forcing against Monta accounts. The issue affects monta.app (all versions tracked by EUVD) and carries a CVSS 4.0 base score of 8.7 (High), with the assessed impact concentrated on availability (VA:H) and no direct confidentiality or integrity effect in the base vector; credential compromise via brute force is a downstream outcome that additionally requires weak, guessable, or non-MFA-protected credentials. No public exploit code has been identified at time of analysis, and the flaw has not been confirmed as actively exploited (CISA KEV); reporting originates from CISA ICS-CERT advisory ICSA-26-274-02.
Unauthenticated session prediction in Monta App's WebSocket backend permits remote attackers to impersonate other charging station sessions or cause denial of service by reusing predictable charging-station identifiers. The CVSS 3.1 base score of 7.3 reflects network reachability, low complexity, no privileges required, and limited confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis.
Authentication identifiers for Monta-managed charging stations are published on publicly accessible web-based mapping platforms, so any remote, unauthenticated party can retrieve them simply by browsing those maps. The exposure is rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) and stems from insufficiently protected credentials (CWE-522); EUVD-2026-91820 lists all versions of monta.app as affected. Impact is bounded to a confidentiality disclosure that enables follow-on misuse rather than direct station or account takeover, since how far the leaked identifiers can be abused depends on how Monta's backend trusts them; there is no public exploit identified at time of analysis and CISA ICSA-26-274-02 does not confirm active exploitation.
Unauthenticated WebSocket endpoints in the Monta EV charging platform (monta.app, all versions) allow any network-reachable attacker to impersonate a charging station and thereby read sensitive backend data or perform unauthorized actions on the platform. The weakness is a missing-authentication flaw (CWE-306) rated 9.3 under CVSS 4.0 and mapped by the independent assessment to CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact and low availability impact, meaning unauthenticated remote attackers need no credentials, user interaction, or non-default configuration - network reachability to the charging-station WebSocket service is the only practical prerequisite. There is no public exploit identified at time of analysis and no KEV listing, but ICS-CERT has published an advisory covering all versions, and the absence of a version-based mitigation makes exposure reduction the primary interim control.
Missing rate limiting on the Monta EV-charging platform's WebSocket API authentication endpoint allows unauthenticated remote attackers to send unlimited login requests, enabling either resource-exhaustion denial of service or sustained credential brute-forcing against Monta accounts. The issue affects monta.app (all versions tracked by EUVD) and carries a CVSS 4.0 base score of 8.7 (High), with the assessed impact concentrated on availability (VA:H) and no direct confidentiality or integrity effect in the base vector; credential compromise via brute force is a downstream outcome that additionally requires weak, guessable, or non-MFA-protected credentials. No public exploit code has been identified at time of analysis, and the flaw has not been confirmed as actively exploited (CISA KEV); reporting originates from CISA ICS-CERT advisory ICSA-26-274-02.
Unauthenticated session prediction in Monta App's WebSocket backend permits remote attackers to impersonate other charging station sessions or cause denial of service by reusing predictable charging-station identifiers. The CVSS 3.1 base score of 7.3 reflects network reachability, low complexity, no privileges required, and limited confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis.
Authentication identifiers for Monta-managed charging stations are published on publicly accessible web-based mapping platforms, so any remote, unauthenticated party can retrieve them simply by browsing those maps. The exposure is rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) and stems from insufficiently protected credentials (CWE-522); EUVD-2026-91820 lists all versions of monta.app as affected. Impact is bounded to a confidentiality disclosure that enables follow-on misuse rather than direct station or account takeover, since how far the leaked identifiers can be abused depends on how Monta's backend trusts them; there is no public exploit identified at time of analysis and CISA ICSA-26-274-02 does not confirm active exploitation.