important · Privilege
Unauthenticated network callers can impersonate charging stations connected to Monta’s cloud platform.
Affects
Monta's hosted electric-vehicle charging platform and charging stations connected to it through WebSockets.
The Internet-facing station WebSocket service accepts connections without an account or user interaction.
Detail and 2 sources
An accepted caller can act in a charging station’s authority context, access station data and perform unauthorized actions.
No complete shipped fix or demonstrated exploit appears in the held evidence.