The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In October 2026, CISA disclosed critical vulnerabilities in Monta's electric vehicle charging platform affecting all versions of monta.app. The vulnerabilities include missing authentication for WebSocket endpoints (CVE-2026-95102), lack of rate limiting enabling brute-force attacks (CVE-2026-97363), insufficient session management (CVE-2026-97212), and publicly exposed charging station credentials (CVE-2026-93474). These flaws allow attackers to impersonate charging stations, gain unauthorized administrative control, disrupt charging services, and potentially compromise the entire EV charging network infrastructure. The vulnerabilities affect critical energy and transportation infrastructure deployed worldwide.

This incident highlights the growing cybersecurity risks in smart city and critical infrastructure as IoT devices proliferate without adequate security controls. With electric vehicle adoption accelerating globally and charging networks becoming essential infrastructure, these vulnerabilities expose systemic weaknesses in industrial control systems that could enable nation-state actors or cybercriminals to disrupt transportation and energy systems at scale.

Why This Matters Now

Electric vehicle infrastructure is rapidly expanding as a critical component of national energy security and transportation systems. These vulnerabilities expose fundamental authentication and session management flaws that could enable coordinated attacks on charging networks, potentially disrupting transportation infrastructure and undermining public confidence in EV adoption during a critical transition period.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

These vulnerabilities primarily impact NIST Cybersecurity Framework controls for asset management, access control, and anomaly detection, along with critical infrastructure protection requirements under NERC CIP for energy sector assets.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would likely reduce the blast radius of this EV charging infrastructure attack by constraining lateral movement between charging stations and limiting unauthorized access to backend management systems through microsegmentation and identity-aware controls.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Zero Trust fabric controls would likely constrain initial attack reachability by enforcing identity verification for WebSocket connections and reducing the scope of accessible endpoints from external networks.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation policies would likely limit the scope of privilege escalation by isolating administrative functions from operational charging systems and constraining access to management interfaces based on verified identity contexts.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic controls would likely constrain lateral movement between charging stations by enforcing workload-specific communication policies and reducing reachability across the charging network infrastructure even with harvested credentials.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud visibility controls would likely constrain persistent C2 channels by detecting anomalous connection patterns and limiting concurrent session establishment from compromised station identifiers across the distributed charging infrastructure.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress security policies would likely constrain data exfiltration by limiting outbound communication paths from charging station networks and reducing the scope of accessible backend database systems through controlled egress enforcement.

Impact (Mitigations)

While service disruption may still occur within compromised segments, the overall impact scope would likely be constrained to isolated charging station groups rather than affecting the entire network infrastructure.

Impact at a Glance

Affected Business Functions

  • Electric Vehicle Charging Operations
  • Energy Distribution Management
  • Transportation Infrastructure Services
  • Customer Payment Processing
Operational Disruption

Estimated downtime: N/A

Financial Impact

Estimated loss: N/A

Data Exposure

Charging station authentication credentials and session identifiers publicly accessible, potentially exposing customer charging data and station control mechanisms to unauthorized access

Recommended Actions

  • • Implement Zero Trust Segmentation with identity-based policies to prevent unauthorized charging station impersonation and require proper authentication for all WebSocket connections
  • • Deploy Egress Security & Policy Enforcement to monitor and control outbound traffic from charging infrastructure, preventing unauthorized data exfiltration to external destinations
  • • Enable Multicloud Visibility & Control to detect anomalous interactions, repeated malformed requests, and suspicious automation patterns across the charging network infrastructure
  • • Implement Threat Detection & Anomaly Response capabilities to baseline normal charging station behavior and alert on brute-force attacks, excessive authentication attempts, and unauthorized session creation
  • • Deploy Encrypted Traffic (HPE) protection to secure all data in transit between charging stations and backend systems, preventing packet sniffing and man-in-the-middle attacks on sensitive charging and payment data

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image