Skip to content
OpenAdvisories
Critical ICSA-26-188-01 3 CVEs

Hydro-Québec Le Circuit Electrique charging station backend

Published Jul 7, 2026 · Updated Jul 7, 2026

Vendor: Hydro-Québec Product: Le Circuit Electrique charging station backend

Summary

Successful exploitation of these vulnerabilities could lead to privilege escalation, or result in a denial-of-service attack.

Vulnerabilities 3

  • Critical 9.8
    CVE-2026-20744

    Hydro-Québec Le Circuit Electrique charging station backend Improper Access Control

    The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation.

    Hydro-Québec Le Circuit Electrique charging station backend
  • High 7.5
    CVE-2026-42952

    Hydro-Québec Le Circuit Electrique charging station backend Improper Restriction of Excessive Authentication Attempts

    Previously, there was no throttling on repeated authentication attempts to the charging station backend, which could allow an attacker to execute a denial-of-service attack.

    Hydro-Québec Le Circuit Electrique charging station backend
  • High 7.5
    CVE-2026-44383

    Hydro-Québec Le Circuit Electrique charging station backend Insufficient Session Expiration

    Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend.

    Hydro-Québec Le Circuit Electrique charging station backend

Revision history

  1. #1

    Initial Publication

References