A Station Identifier Is Not Proof of Station Identity

Cybersecurity Under Pressure. Real Attacks, Real Lessons · Oct 23, 2026 · 52m

What happens when an EV charging backend accepts a station identifier without proving which station is actually connecting?

This episode examines the Monta OCPP authentication weakness described in CVE-2026-95102 and CISA ICSA-26-274-02. We break down how identifier-based trust can enable station impersonation, why possession of an ID is not authentication, and what operators should enforce at the WebSocket and deployment layers.

We also separate demonstrated impact from broader speculation: the issue supports unauthorized station identity claims, but it does not by itself prove widespread…