CISA Warns of Critical Authentication Gaps in Monta Charging Services
Tech GuruQuick Answer
CISA ICSA-26-274-02 describes authentication, request-rate and station-identity weaknesses in monta.app. No discrete fixed version is stated. Operators should coordinate authenticated charging-station connections using OCPP 1.6 Security Profile 2 (HTTP Basic Auth with TLS) and obtain confirmation of provider-side controls for their deployment.
Confirm Authentication And Provider Controls
What to do now: inventory affected stations and connection profiles, agree a supported authenticated migration with Monta and the station vendor, and verify service continuity. A mobile-app update or TLS encryption without station authentication does not establish remediation.
Last verified: 2026-10-02 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Monta monta.app charging-platform service |
|---|---|
| Advisory | ICSA-26-274-02 |
| CVEs | CVE-2026-93474, CVE-2026-95102, CVE-2026-97212, CVE-2026-97363 |
| Authoritative release date | 2026-10-01 (CISA public advisory date; CSAF current release 2026-10-01 06:00 UTC) |
| Authority revision date | Initial public publication; no later material revision stated when verified |
| Affected versions | All versions of monta.app, as stated by CISA. |
| Fixed version | No discrete fixed version is stated; enable OCPP 1.6 Security Profile 2, use TLS-authenticated connections, and confirm Monta's managed throttling controls |
| CVSS base score | 6.5 / 7.3 / 7.5 / 9.4 (official CVSS v3.1) |
| CVSS severity | Medium to Critical |
| Exploitation status | CISA reports no known public exploitation specifically targeting these vulnerabilities; no exploitation claim is inferred. |
What Changed
The advisory describes missing WebSocket authentication, unrestricted authentication attempts, predictable station/session identifiers and publicly exposed identifiers. Monta states that it is retiring unauthenticated access progressively and has deployed throttling. These are provider statements and mitigations, not evidence that every station already uses the required authenticated profile.
What To Validate Now
- Inventory. Locate Monta monta.app charging-platform service deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Match the exact product and affected-version statement in ICSA-26-274-02. Do not generalize the finding to another product, service, or release.
- Remediate. Confirm support and provision unique station credentials through the vendor-supported OCPP 1.6 Profile 2 process, including TLS certificate trust. Ask Monta to confirm unauthenticated access restrictions, throttling and duplicate-session behavior for the actual account/stations. Keep credentials and station connection details out of public tickets.
- Validate. Use an authorized maintenance/test station to check authenticated reconnection, ordinary charging, stop, metering and billing records. Review unexplained reconnects, administrative commands and identifier conflicts. Do not flood the service or impersonate a live station as an acceptance test.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Coordinate changes with charging operations and confirm recovery access before switching connection profiles. Do not interrupt an occupied charging session to demonstrate a fix. Retain provider confirmation and any unauthenticated exceptions; no live charging or throttling test was performed here.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
