Monta monta.app
CISA says unauthenticated WebSocket flaws in every Monta monta.app version could let attackers control charging stations.
CISA advisory ICSA-26-274-02 covers every version of Monta monta.app, used for charging stations in energy and transportation. CVE-2026-95102 (CVSS 3.1 9.4) lets unauthenticated attackers impersonate stations through WebSocket endpoints. CVE-2026-97363 omits authentication rate limits, CVE-2026-97212 allows reusable predictable sessions, and CVE-2026-93474 exposes station identifiers on web maps. CISA says exploitation could give administrative control or disrupt charging, and reports no known public exploitation.
- CVE-2026-95102 is CVSS 9.4 missing WebSocket authentication.
- Related flaws allow brute force, session abuse, and exposed station identifiers.
- Every monta.app version is affected in energy and transportation deployments.
- CISA reports no known public exploitation at this time.
- Vendors
- Monta
- Products
- monta.app
- Organizations
- CISA
- Countries
- Netherlands
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-95102+1 related CVE | Missing WebSocket authentication in Monta monta.app | 9.3 group max | — | ||
CVE-2026-97363+1 related CVE | Missing auth rate limit in Monta WebSocket API | 8.7 group max | — |
From the original article
3 min read at cisa.govView CSAF Summary Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks. The following versions of Monta monta. app are affected: monta.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.