Description
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to privilege escalation and potentially compromise the security of the entire system.
Published: 2026-10-02
Score: 9.3 Critical
EPSS: n/a
KEV: No
Impact: Unauthorized access and privilege escalation via unauthenticated WebSocket connections
Action: Immediate Patch
AI Analysis

Impact

WebSocket endpoints in Monta’s monta.app platform do not enforce authentication, allowing attackers to impersonate charging stations and issue commands or read sensitive data. This represents a CWE‑306 Missing Authentication flaw that can enable privilege escalation and compromise system integrity.

Affected Systems

The affected product is Monta’s monta.app charging infrastructure, with no specific version information provided in the advisory. Operators should verify which deployments are running the vulnerable component.

Risk and Exploitability

The vulnerability has a CVSS score of 9.3, indicating high severity. The EPSS score is not reported, and it is not listed in the CISA KEV catalog. Attackers can exploit it by sending unauthenticated WebSocket requests from any network path that can reach the endpoint; no special privileges or authentication are required, making exploitation trivial for an attacker who can reach the target.

Generated by OpenCVE AI on October 2, 2026 at 22:20 UTC.

Remediation

Vendor Workaround

Monta states that they are actively working to increase adoption of authenticated connections across their network and to deprecate unauthenticated access on a rolling basis. Monta states that they provide support for OCPP 1.6 Security Profile 2 (HTTP Basic Auth with TLS) and encourage operators to enable it.

OpenCVE Recommended Actions

  • Enable OCPP 1.6 Security Profile 2 (HTTP Basic Auth with TLS) so that all charging station connections require authentication.
  • Disable or block unauthenticated WebSocket access, ensuring only authenticated connections are accepted.
  • Apply any vendor‑provided patch or update for monta.app that resolves the authentication issue.

Generated by OpenCVE AI on October 2, 2026 at 22:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 02 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Description WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to privilege escalation and potentially compromise the security of the entire system.
Title Monta monta.app Missing Authentication for Critical Function
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 9.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: icscert

Published:

Updated: 2026-10-02T21:34:37.182Z

Reserved: 2026-09-24T16:22:04.106Z

Link: CVE-2026-95102

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-02T22:16:56.607

Modified: 2026-10-02T22:16:56.607

Link: CVE-2026-95102

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T22:30:19Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function