CISA Warns of Flaws in IoT and EV Charging Platforms
CISA Warns of Critical Flaws in IoT, EV Charging, and Access Control
Related Entities
Organizations
Products & Tech
CVE Identifiers
Full Report
Executive Summary
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published a series of advisories highlighting significant vulnerabilities in various Internet of Things (IoT) and Operational Technology (OT) systems. The warnings cover flaws in the Meari IoT Cloud Platform, the Monta electric vehicle (EV) charging platform, and the Armatura One access control system. The vulnerabilities range from missing authorization and device takeover to a critical 9.4 CVSS flaw enabling EV charging station impersonation. One of the flaws, affecting an Apache ActiveMQ component in Armatura One, is known to be exploited in other contexts, increasing the risk. CISA recommends immediate mitigation actions, including patching and network hardening.
Vulnerability Details
CISA's advisories detail several distinct sets of vulnerabilities:
Meari IoT Cloud Platform
- CVE-2026-101104 (CVSS 7.7): A missing authorization flaw in the OpenAPI Service that could allow an authenticated user to manipulate IoT devices they do not own.
- CVE-2026-96613 (CVSS 6.5): Another missing authorization flaw allowing an attacker to retrieve device shadow information, potentially including credentials and telemetry.
Important Note: Meari has not responded to coordination attempts, and no patches are available for these vulnerabilities.
Monta EV-Charging Platform
- CVE-2026-95102 (CVSS 9.4): A critical unauthenticated WebSocket endpoint vulnerability. An attacker could exploit this to impersonate a charging station, potentially leading to unauthorized actions like starting/stopping charging sessions or intercepting data.
- Several other less severe flaws were also disclosed. Monta is reportedly working on fixes.
Armatura One Access Control System
- Five vulnerabilities were detailed, with impacts including unauthorized database access, system control, and arbitrary code execution.
- One notable flaw is CVE-2023-46604, a deserialization of untrusted data vulnerability in an embedded Apache ActiveMQ component. This specific CVE has been actively exploited in other products, making it a high-priority concern.
Affected Systems
- Meari IoT Cloud Platform OpenAPI Service: All versions.
- Monta monta.app EV-charging platform: All versions.
- Armatura One: All versions prior to the latest patched releases.
Exploitation Status
There is no evidence that the new vulnerabilities in Meari or Monta are being exploited in the wild. However, the vulnerability in Armatura One (CVE-2023-46604) is a well-known flaw that has been exploited by threat actors in various campaigns targeting other software that uses the vulnerable ActiveMQ component. This significantly increases the risk for organizations using unpatched Armatura One systems.
Impact Assessment
The impact varies by platform:
- Meari: Attackers could take over other users' IoT devices (e.g., cameras, smart plugs) and access sensitive data.
- Monta: The ability to impersonate charging stations could disrupt EV charging networks, lead to billing fraud, or potentially be used in larger, coordinated attacks on energy infrastructure.
- Armatura: Full compromise of the physical access control system could allow unauthorized physical entry into secure facilities, alongside the risk of data theft and lateral movement within the network.
IOCs — Directly from Articles
No specific Indicators of Compromise (IOCs) were provided in the source articles.
Cyber Observables — Hunting Hints
Security teams should hunt for the following patterns to identify potential exploitation:
61616Detection Methods
- Network Traffic Analysis: Monitor network traffic for anomalous connections to the affected services. For Armatura, specifically look for unexpected traffic over the ActiveMQ port (
61616). For Monta, analyze WebSocket traffic for signs of impersonation. - Asset Inventory and Vulnerability Scanning: Maintain a complete inventory of all IoT and OT devices. Use vulnerability scanners to identify instances of the affected platforms, especially the vulnerable ActiveMQ component in Armatura One.
- Log Review: Review application and system logs on affected systems for error messages, unauthorized access attempts, or other signs of compromise.
Remediation Steps
- Patch Immediately: For Armatura One, update to the latest version to mitigate CVE-2023-46604 and the other flaws.
- Monitor Vendor Updates: For Monta, monitor for the release of patches and apply them as soon as they become available.
- Reduce Network Exposure: For all affected systems, especially the unpatched Meari platform, minimize their exposure to the internet. If possible, place them behind a firewall and restrict access to only trusted IP addresses.
- Network Segmentation: Isolate IoT and OT devices on separate network segments to prevent lateral movement in the event of a compromise.
Timeline of Events
MITRE ATT&CK Mitigations
Update Software
Apply vendor patches for Armatura and Monta as soon as they are available.
Mapped D3FEND Techniques:
Isolate IoT and OT devices from the corporate IT network to limit the blast radius of a compromise.
Mapped D3FEND Techniques:
For unpatched systems like Meari, restrict network access to the absolute minimum required for functionality.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.