CISA Issues Advisory for Four Critical Vulnerabilities in Monta monta.app Charging Station Software

The Cybersecurity and Infrastructure Security Agency (CISA) has issued Industrial Control Systems advisory ICSA-26-274-02, revealing four security vulnerabilities in Monta monta.app, the charging station management software used across global electric vehicle infrastructure. The advisory was published on October 1, 2026.

The identified flaws are:

- CVE-2026-95102: Rated 9.4 (Critical). WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations, gain unauthorized access to sensitive data, and perform unauthorized actions. No authentication is required for exploitation, which could lead to privilege escalation across the entire system.

- CVE-2026-97363: Rated 7.5 (High). The WebSocket API lacks restrictions on the number of authentication requests, potentially allowing denial-of-service attacks or brute-force attempts to gain unauthorized access.

- CVE-2026-97212: Rated 7.5 (High). The WebSocket backend uses charging station identifiers to associate sessions but permits multiple endpoints to connect using the same session identifier, resulting in predictable session IDs. This could allow unauthorized authentication as other users or facilitate denial-of-service conditions.

- CVE-2026-93474: Details not fully enumerated in the source data but listed alongside the other three CVEs affecting all versions of Monta monta.app.

All versions of Monta monta.app (vers:all/*) are affected. The software is deployed worldwide, with the vendor's headquarters located in the Netherlands. Affected critical infrastructure sectors include Energy and Transportation Systems.

CISA notes that no confirmed active exploitation in the wild has been reported as of the advisory publication. However, the combination of missing authentication, absent rate limiting, and predictable session identifiers presents a significant risk to charging station operations.

In response, Monta states they are actively working to increase adoption of authenticated connections and deprecate unauthenticated access on a rolling basis. The vendor supports OCPP 1.6 Security Profile 2 (HTTP Basic Auth with TLS) and encourages operators to enable it. Additional interim mitigations include implementation of rate limiting and automated connection throttling at the WebSocket layer, where connections exhibiting abusive patterns such as rapid reconnection, ID brute-forcing, or excessive command volume are automatically identified and blocked.