Source: cisa.gov
CISA has issued an ICS advisory for Monta monta.app, an EV charging station management platform, disclosing four vulnerabilities affecting all versions. The most critical (CVE-2026-95102, CVSS 9.4) involves missing authentication on WebSocket endpoints, allowing attackers to impersonate charging stations and gain unauthorized administrative control. CVE-2026-97363 involves lack of rate limiting on authentication requests, enabling brute-force and denial-of-service attacks. CVE-2026-97212 involves insufficient session expiration with predictable session identifiers, allowing session hijacking and DoS. CVE-2026-93474 involves publicly accessible charging station authentication identifiers via web-based mapping platforms. Successful exploitation could allow unauthorized administrative control over charging stations or disruption of charging services. The affected product is deployed worldwide in Energy and Transportation sectors. Monta is mitigating through rate limiting, connection throttling, and encouraging adoption of OCPP 1.6 Security Profile 2 with TLS. No known active exploitation has been reported at this time.
