CVE-2026-95102

LOWCVSS 9.3 · CRITICAL

Signal is active with 3 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to privilege escalation and potentially compromise the security of the entire system.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-306

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

3 mentions across 1 observed day

What's happening

3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d

Referenced assets2 URLs

By indicator

Full discourse3 posts

NewsTongue@NewsTongueX1d
🔴 Monta EV charging platform hit by 4 critical WebSocket auth flaws Monta http://monta.app—deployed globally across energy and transportation sectors—contains four vulnerabilities (CVE-2026-95102, CVE-2026-97363, CVE-2026-97212, CVE-2026-93474) that enable attackers to gain unauthorized administrative control over charging stations or disrupt services via denial-of-service. WebSocket endpoints lack authentication, allowing attackers to impersonate stations and escalate privileges. Charging station identifiers are publicly accessible via web mapping platforms.
0000029
951 followersView on X
NewsTongue@NewsTongueX1d
🔴 Monta EV charging platform hit by 4 critical WebSocket auth flaws Monta http://monta.app—deployed globally across energy and transportation sectors—contains four vulnerabilities (CVE-2026-95102, CVE-2026-97363, CVE-2026-97212, CVE-2026-93474) that enable attackers to gain unauthorized administrative control over charging stations or disrupt services via denial-of-service. WebSocket endpoints lack authentication, allowing attackers to impersonate stations and escalate privileges. Charging station identifiers are publicly accessible via web mapping platforms.
0000029
951 followersView on X
NewsTongue@NewsTongueX1d
🔴 Monta EV charging platform hit by 4 critical WebSocket auth flaws Monta http://monta.app—deployed globally across energy and transportation sectors—contains four vulnerabilities (CVE-2026-95102, CVE-2026-97363, CVE-2026-97212, CVE-2026-93474) that enable attackers to gain unauthorized administrative control over charging stations or disrupt services via denial-of-service. WebSocket endpoints lack authentication, allowing attackers to impersonate stations and escalate privileges. Charging station identifiers are publicly accessible via web mapping platforms.
0000038
951 followersView on X

Explore more

Back to dashboard