Description
Charging station authentication identifiers are publicly accessible via web-based mapping platforms.
Published: 2026-10-02
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Credential exposure leading to unauthorized station control
Action: Apply Workaround
AI Analysis

Impact

The vulnerability allows an attacker to obtain charging station identifiers and potentially credentials because they are publicly accessible through web‐based mapping platforms; this exposure enables unauthorized access to station management functions and is a classic case of insufficiently protected credentials (CWE‑522).

Affected Systems

The affected product is Monta’s Monta.app platform. No specific version information is available in the advisory, so any deployment of Monta.app remains potentially vulnerable until a dedicated fix is released.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV database. The attack vector is inferred to be remote, as the credentials are exposed over the internet via public web mapping interfaces. Mitigations are limited to the workaround described by Monta, which emphasizes moving to authenticated connections and implementing rate limiting at the WebSocket layer.

Generated by OpenCVE AI on October 2, 2026 at 22:22 UTC.

Remediation

Vendor Workaround

Monta states that they are actively working to increase adoption of authenticated connections across their network and to deprecate unauthenticated access on a rolling basis. Monta states that they provide support for OCPP 1.6 Security Profile 2 (HTTP Basic Auth with TLS) and encourage operators to enable it.

OpenCVE Recommended Actions

  • Enable and enforce authentication (e.g., HTTP Basic Auth with TLS) on all Monta.app connections following the OCPP 1.6 Security Profile 2 recommendations.
  • Phase out unauthenticated access gradually, ensuring that only authenticated sessions can reach station controls.
  • Apply Monta’s built‑in rate limiting and automated connection throttling at the WebSocket layer to reduce the risk of brute‑force or abuse attempts.

Generated by OpenCVE AI on October 2, 2026 at 22:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 02 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Charging station authentication identifiers are publicly accessible via web-based mapping platforms.
Title Monta monta.app Insufficiently Protected Credentials
Weaknesses CWE-522
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: icscert

Published:

Updated: 2026-10-02T21:27:59.493Z

Reserved: 2026-09-24T16:22:04.115Z

Link: CVE-2026-93474

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-02T22:16:55.873

Modified: 2026-10-02T22:16:55.873

Link: CVE-2026-93474

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T22:30:19Z

Weaknesses
  • CWE-522

    Insufficiently Protected Credentials