by Kastro
Paper/Archive/CVE-2026-95102

CVE-2026-95102

Monta monta.app — Monta monta.app Missing Authentication for Critical Function

EPSS 0.4%CVSS 9.4
critical.is priorityof 100
34
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 29.9.299 × 206.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to privilege escalation and potentially compromise the security of the entire system.

Affected

ProductAffectedFixed inSource
monta.appAll versions–CNA

Scores by source

icscert (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-26-274-02refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-02.json