Monta monta.app: Improper restriction of excessive authentication attempts
Summary
The WebSocket API of the Monta monta.app EV charging platform does not limit the number of authentication requests. An attacker can use this to run brute-force attacks to gain unauthorized access or to cause denial-of-service conditions that disrupt charging. No prior access is required, as the WebSocket endpoint is reachable over the internet. The CVSS v4.0 base score is 8.7 (High), and NVD had not yet completed its analysis at the time of publication.
Affected
- Monta monta.app, all versions (vers:all/*) according to CISA ICSA-26-274-02
Fixed in
Unknown. No fixed version is published. Monta operates the platform, so any fix is applied server-side by the vendor.
Workaround
- Monta states that it has implemented rate limiting and automatic connection throttling at the WebSocket layer; the effectiveness is not independently verified.
- Monta supports OCPP 1.6 Security Profile 2 (HTTP Basic Auth with TLS) and encourages operators to enable it where stations support it.
- Monta states it is working to move all connections to authenticated access and to deprecate unauthenticated access.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No known exploitation in the wild; the CVE is not listed in CISA KEV.
- No public proof of concept known.
Our recommendation
- If you run charging stations through Monta (for example fleet, car park or workplace charging), treat this as high priority.
- Ask Monta in writing for the status of the rate-limiting measures and the timeline for ending unauthenticated connections.
- Check whether your stations support OCPP 1.6 Security Profile 2 and enable it.
- Monitor for unusual reconnection or login activity on your charging stations and report anomalies to Monta.
- Keep charging infrastructure off open networks where possible and segment it from business networks.
- If you do not use Monta, no action is needed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CISA ICS advisory ICSA-26-274-02 www.cisa.gov
- CISA CSAF document ICSA-26-274-02 github.com
- Vulners CVE-2026-95102 (sibling CVE in same advisory) vulners.com
- Strix CVE-2026-97363 (KEV status) www.strix.ai
- Aviatrix advisory analysis (exploit status, third-party) aviatrix.ai
- CVE threat intelligence record CVE-2026-97363 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:44.
Original description (NVD)
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.