Security Flaws Found in Monta Charging Stations

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical advisory regarding security vulnerabilities in Monta's charging stations, which could potentially allow attackers to gain unauthorized control or disrupt services. Monta, a company headquartered in the Netherlands, is facing significant cybersecurity challenges affecting its charging stations globally.

According to CISA, the vulnerabilities are present in all versions of Monta's monta.app software, identified by the CVE identifiers CVE-2026-95102, CVE-2026-97363, CVE-2026-97212, and CVE-2026-93474. These flaws could enable attackers to impersonate charging stations, gain unauthorized access to sensitive data, and perform unauthorized actions, thereby compromising the security of the entire system.

Vulnerabilities and Potential Impact

The vulnerabilities primarily stem from inadequate authentication mechanisms in the WebSocket endpoints, which allow attackers to impersonate charging stations. This lack of authentication can lead to privilege escalation, unauthorized access, and potential system compromise. Additionally, the WebSocket API lacks rate limiting, making it susceptible to denial-of-service attacks or brute-force attempts to gain unauthorized access.

CISA highlights that the WebSocket backend permits multiple endpoints to connect using the same charging station identifier, which can result in predictable session identifiers. This flaw may allow unauthorized users to authenticate as other users or overwhelm the backend with session requests, causing service disruptions.

Critical Infrastructure at Risk

The vulnerabilities affect critical infrastructure sectors, including Energy and Transportation Systems, and have a global deployment. The potential for attackers to disrupt charging services through denial-of-service attacks poses a significant risk to these sectors.

Monta's Response and Mitigations

Monta is actively working to address these vulnerabilities by increasing the adoption of authenticated connections across their network and deprecating unauthenticated access. The company supports OCPP 1.6 Security Profile 2, which includes HTTP Basic Auth with TLS, and encourages operators to enable it.

To mitigate the risks, Monta has implemented rate limiting and automated connection throttling at the WebSocket layer. This measure aims to identify and block connections exhibiting abusive patterns, such as rapid reconnection or excessive command volume. Additionally, Monta's platform now handles duplicate connection attempts according to the OCPP specification, where a new authenticated connection supersedes an existing session for the same station ID.

CISA's advisory underscores the critical nature of these vulnerabilities, with a CVSS base score of 9.4, indicating a severe risk level. Monta's efforts to address these issues are ongoing, as they work to enhance the security of their charging stations and protect critical infrastructure sectors from potential cyber threats.