Monta monta.app (CVE-2026-95102, CVE-2026-97363, CVE-2026-97212 +1 more)
Four unpatched vulnerabilities in Monta's EV charging platform enable unauthorized administrative control and denial-of-service attacks against charging stations worldwide. WebSocket endpoints lack authentication, rate limiting, and session validation across all versions of monta.app. Attackers can impersonate charging stations using publicly exposed identifiers, brute-force authentication, or hijack predictable sessions. Energy and transportation sectors are affected globally with no patched version available.
Detection / Hunteropenrouter
Immediate Actions
- Enable OCPP 1.6 Security Profile 2 with HTTP Basic Auth and TLS
- Restrict internet exposure of charging station management interfaces
Key Takeaways
- CVE-2026-95102 carries CVSS 9.4 Critical for missing WebSocket endpoint authentication.
- Charging station authentication identifiers are publicly accessible via web mapping platforms.
- All versions of Monta monta.app affected with no patched release available.
- Vendor implemented rate limiting and connection throttling as partial WebSocket-layer mitigations.
- OCPP 1.6 Security Profile 2 with HTTP Basic Auth and TLS is supported but not enforced.
Attack Chain
- Reconnaissance: Attacker gathers charging station identifiers from public web mapping platforms
- Initial Access: Attacker connects to unauthenticated WebSocket endpoints using discovered identifiers
- Privilege Escalation: Predictable session identifiers enable impersonation of legitimate charging stations
- Impact: Attacker gains administrative control or triggers denial-of-service via excessive session requests
Affected Systems
- Monta monta.app (all versions)
- EV charging stations using OCPP protocol
- Energy sector charging infrastructure
- Transportation systems charging infrastructure
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-95102 | Monta monta.app | Critical | Missing WebSocket authentication enables station impersonation and privilege escalation. |
| CVE-2026-97363 | Monta monta.app | High | No rate limiting on WebSocket auth requests enables brute-force and DoS attacks. |
| CVE-2026-97212 | Monta monta.app | High | Predictable session identifiers allow user impersonation and backend DoS. |
| CVE-2026-93474 | Monta monta.app | Medium | Charging station authentication identifiers publicly accessible via web mapping platforms. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Primarily network and application-layer vulnerabilities in WebSocket API endpoints. |
| Network Visibility | Medium | WebSocket traffic inspection can reveal unauthenticated connections and brute-force patterns. |
| Detection Difficulty | Moderate | Requires WebSocket protocol awareness and session correlation across charging fleet. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Multiple WebSocket connections from a single IP using different charging station identifiers (T1110). | WebSocket connection logs with source IP | Credential Access | Low — multiple station IDs per IP is unusual |
| Concurrent WebSocket sessions with identical station identifiers from different source IPs (T1550.004). | Application session logs with station ID | Defense Evasion | Medium — legitimate failover may cause duplicates |
| Rapid reconnection attempts to WebSocket endpoints exceeding baseline rates (T1499). | Connection rate metrics from reverse proxy | Impact | Low — abnormal reconnection rates are suspicious |
Required Log Sources
- WebSocket connection logs
- Application authentication logs
- Network flow data
- Charging station management logs
- WAF or reverse proxy logs
Key Behavioral Indicators
- Multiple concurrent sessions with same station ID
- WebSocket connections without authentication headers
- Rapid reconnection patterns to charging endpoints
- Station ID enumeration from single source IP
Control Gaps
- WAF rules may not inspect WebSocket traffic
- Traditional auth controls miss unauthenticated endpoints
- Rate limiting absent at WebSocket application layer
False Positive Assessment
Low — specific vulnerability patterns in a known product with clear indicators.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Isolate charging infrastructure networks from business networks using firewalls
- Use VPN for remote access to charging station management systems
- Implement network-level rate limiting for WebSocket connections
User Protection
- Monitor charging station behavior for signs of unauthorized administrative commands
MITRE ATT&CK Mapping
Reconnaissance
Initial Access
Credential Access
Lateral Movement
Impact
Plain-Language Summary
A security researcher found four flaws in Monta's electric vehicle charging software. The flaws could let attackers take control of charging stations or shut down charging services. The problems affect charging networks used in the energy and transportation sectors worldwide. Operators should enable authenticated connections and restrict internet access to charging station systems until a fix is available.
- cveCVE-2026-93474Charging station authentication identifiers publicly accessible via web mapping platforms.
- cveCVE-2026-95102Missing WebSocket authentication enables station impersonation and privilege escalation.
- cveCVE-2026-97212Predictable session identifiers allow user impersonation and backend DoS.
- cveCVE-2026-97363No rate limiting on WebSocket auth requests enables brute-force and DoS attacks.