CISA Warns of Monta EV Charging Vulnerabilities

CISA warned of multiple critical vulnerabilities in the Monta EV charging cloud platform that allow unauthenticated attackers to impersonate stations, hijack sessions, or disrupt charging services via DoS. The flaws stem from missing WebSocket authentication, lack of rate limiting, and shared session identifiers; thousands of commercial chargers may be affected. Monta deployed automated rate limiting and recommends enabling OCPP 1.6 Security Profile 2, TLS authentication, and network isolation as mitigations.