CVE-2026-95102

WebSocket endpoints in Monta’s monta.app charging platform do not enforce authentication (CWE-306). A remote attacker can connect without credentials and impersonate a charging station, then read sensitive data or take unauthorized actions, including privilege escalation that could compromise the wider system. The issue is rated critical (CVSS 4.0 9.3): it is network-reachable with no privileges or user interaction required, and it has high confidentiality and integrity impact and low availability impact on the vulnerable component. Charge-point operators and sites that rely on monta.app are affected; affected version ranges were not published in the advisory data. The CVE is not listed in CISA KEV and no public proof-of-concept is known.

What to do: Apply the vendor fix from Monta or the ICS-CERT advisory as soon as a patched release is published. Until then, restrict network access to monta.app WebSocket endpoints to trusted charge-point networks, require authentication on those endpoints, and review charger identities and recent sessions for unexpected connections or impersonated stations.