OTPulse

Monta monta.app

Plan PatchCVSS 9.4ICS-CERT ICSA-26-274-02Oct 1, 2026
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

Monta.app charging station management platform contains multiple authentication and session management vulnerabilities (CWE-306: Missing Authentication, CWE-307: Improper Restriction of Rendered UI Layers, CWE-613: Insufficient Session Expiration, CWE-522: Insufficiently Protected Credentials). All versions are affected. Successful exploitation could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services. The platform has implemented rate limiting and automated connection throttling at the WebSocket layer to block abusive patterns including rapid reconnection, ID brute-forcing, and excessive command volume. Monta supports OCPP 1.6 Security Profile 2 with HTTP Basic Auth and TLS and is deprecating unauthenticated access on a rolling basis.

What this means
What could happen
An attacker could gain unauthorized administrative control of EV charging stations managed by Monta, allowing them to prevent customers from charging vehicles or extract sensitive transaction data. Disruption could affect public charging networks and station operator revenue.
Who's at risk
EV charging station operators using Monta.app should be concerned. This affects any organization managing electric vehicle charging networks, including municipal utilities, commercial charging networks, fleet operators, and parking facility managers.
How it could be exploited
An attacker with network access to the Monta platform could exploit unauthenticated WebSocket connections and weak credential handling (CWE-306, CWE-307, CWE-613) to bypass authentication, brute-force station IDs, or replay captured sessions to assume administrative privileges over charging stations. This requires no user interaction and can be performed remotely over the internet.
Prerequisites
  • Network access to Monta platform WebSocket endpoints
  • Knowledge of or ability to enumerate charging station IDs
  • No valid credentials required for initial exploitation
remotely exploitableno authentication requiredlow complexityhigh CVSS (9.4)affects customer-facing serviceweak credential handling
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (1)
ProductAffected VersionsFix Status
monta.appAll versionsNo fix yet
Remediation & Mitigation
0/4
Do now
0/3
HARDENINGEnable OCPP 1.6 Security Profile 2 (HTTP Basic Auth with TLS) on all charging stations managed through Monta
HARDENINGConfigure strong, unique credentials for each charging station in OCPP authentication
WORKAROUNDRestrict network access to Monta WebSocket endpoints to known management IP addresses or VPNs where possible
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HARDENINGMonitor charging station connection logs for evidence of repeated failed authentication attempts or rapid reconnections
View full CISA ICS-CERT advisory
API: /api/v1/advisories/c8411356-8c8c-418d-b94a-245d40ba924f

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.