Executive brief
The backend system for Hydro-Québec's Le Circuit Electrique charging stations was found to lack rate-limiting on authentication attempts. This could allow an attacker to flood the system with login requests, potentially causing a service outage for electric vehicle charging management. Hydro-Québec has addressed this by updating charging station protocols and implementing new authentication systems.
Technical details
The vulnerability is classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts). The charging station backend failed to implement throttling or rate-limiting on repeated authentication requests. A remote, unauthenticated attacker could exploit this by sending a high volume of authentication attempts to overwhelm the backend resources, resulting in a denial-of-service (DoS). Hydro-Québec has mitigated the issue by disabling the Open Charge Point Protocol (OCPP) on most stations and implementing enhanced authentication for those still requiring it.
Affected products
- Hydro-Québec Le Circuit Electrique charging station backend Before June 2026
Timeline
- 2026-07-07: advisory: Initial release of ICSA-26-188-01 by CISA
- 2026-07-10: disclosed: CVE published to NVD dataset
- 2026-06-01: patched: Remediation implemented in June 2026 update