Monta monta.app: Missing authentication on WebSocket endpoints
Summary
The WebSocket endpoints of the Monta monta.app charging station platform do not require authentication for connecting charging stations. A remote attacker can impersonate a charging station without credentials, which may allow unauthorized access to data and unauthorized actions, including privilege escalation. CISA rates the impact as total, although no public exploitation has been reported.
Affected
- Monta monta.app, all versions (vers:all/*) according to CISA
- The NVD record was still awaiting analysis at the time of writing
- VulDB lists the affected version as unknown
Fixed in
Unknown. No fixed version is listed; Monta operates the platform as a hosted backend, so remediation is server-side.
Workaround
- Enable OCPP 1.6 Security Profile 2 (HTTP Basic Auth with TLS) on stations, as recommended by Monta
- Monta has added rate limiting and automated connection throttling at the WebSocket layer
- Monta states that a new authenticated connection supersedes an existing session for the same station ID
- Keep control networks off the internet and use secure VPNs for remote access
Exploitation
- No known public exploitation has been reported to CISA
- No public proof-of-concept exploit is known
- Not listed in the CISA KEV catalog
- CISA SSVC: automatable no, technical impact total
Our recommendation
- Ask the operator or Monta whether monta.app is used and whether Security Profile 2 is active for every station
- Ask Monta in writing to confirm that the backend fix and rate limiting are active for your tenant
- Check that station connections are not exposed through unmanaged networks or public gateways
- Monitor for duplicate or unexpected station connections and treat station IDs as public
- Re-check the CISA advisory and NVD for updates
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CISA ICS Advisory ICSA-26-274-02 www.cisa.gov
- CISA CSAF document ICSA-26-274-02 github.com
- VulDB CVE-2026-95102 vuldb.com
- Aviatrix threat research on Monta vulnerabilities aviatrix.ai
- SecurityOnline: Monta EV charging vulnerabilities securityonline.info
- Vulners CVE-2026-95102 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:34.
Original description (NVD)
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to privilege escalation and potentially compromise the security of the entire system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.