Hydro-Québec Le Circuit Electrique Charging Station Backend – Authentication and Session Management Vulnerabilities
First seen Jul 12, 2026 · Updated Jul 12, 2026 · CVSS 9.8
Hydro-Québec's Le Circuit Electrique EV charging station backend contains three vulnerabilities—an unauthenticated websocket endpoint, lack of authentication attempt throttling, and insufficient session/connection controls—that could allow privilege escalation or denial-of-service attacks. The most severe flaw (CVSS 9.8) permits unauthenticated connections to the charging station's OCPP websocket, enabling attackers to potentially impersonate charging stations or escalate privileges. Hydro-Québec has mitigated most affected stations by disabling OCPP or adding authentication.
Technical Analysis
CVE-2026-20744 (CVSS 3.1: 9.8) stems from CWE-284 Improper Access Control, where the charging station websocket endpoint accepts connections without authentication, potentially allowing privilege escalation over the OCPP protocol. CVE-2026-42952 (CVSS 3.1: 7.5) is a CWE-307 issue enabling unthrottled authentication attempts, facilitating brute-force or DoS attacks against the backend. CVE-2026-44383 (CVSS 3.1: 7.5) is a CWE-613 insufficient session expiration flaw allowing multiple concurrent connections under the same charging station ID, letting attackers deploy malicious OCPP client instances to overwhelm the backend. These are OT/ICS vulnerabilities affecting a public EV charging network infrastructure rather than IT systems, with no direct code-execution or data-exfiltration path documented. There is no plausible direct impact to AI agent systems, RAG pipelines, or LLM tool-use frameworks from this advisory, as it targets ICS/OT charging infrastructure without exposed credentials or software components commonly consumed by AI agents.
Affected Systems
Hydro-Québec Le Circuit Electrique charging station backend, all versions prior to June 2026, particularly stations still reliant on OCPP (Open Charge Point Protocol) without updated authentication mechanisms
Indicators of Compromise
- No specific IOCs published; no known public exploitation reported by CISA at this time
Remediation Steps
- 1
Apply vendor mitigations
Contact Hydro-Québec to confirm charging stations have OCPP disabled or updated authentication mechanisms applied, especially for stations still reliant on OCPP.
- 2
Network segmentation
Ensure charging station control system devices are isolated from business networks and not directly accessible from the internet.
- 3
Restrict remote access
Use VPNs or other secure remote access methods for any necessary remote management of charging station infrastructure, keeping VPN software patched and current.
- 4
Monitor for anomalous connections
Watch for multiple simultaneous connections using the same charging station ID or repeated failed authentication attempts indicating brute-force or DoS activity.
- 5
Report suspicious activity
Follow internal incident response procedures and report any suspected malicious activity to CISA for tracking and correlation.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.