EUVD-2026-43095
GHSA-88vc-rc72-29f3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, unauthenticated, low-complexity abuse of an unthrottled auth endpoint whose stated impact is denial-of-service, so A:H with C:N/I:N; the official vector's VI:H conflicts with the DoS description.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
5DescriptionCVE.org
Previously, there was no throttling on repeated authentication attempts to the charging station backend, which could allow an attacker to execute a denial-of-service attack.
AnalysisAI
Denial-of-service exposure in the Hydro-Québec Le Circuit Électrique EV charging-station backend allows remote, unauthenticated attackers to hammer the authentication endpoint without rate limiting, degrading or exhausting the service that charging stations rely on. The flaw (CWE-307, missing throttling of repeated auth attempts) affects all backend versions prior to the June 2026 fix and carries a CVSS 4.0 base score of 8.7. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but it was reported through ICS-CERT and documented in CISA ICS advisory ICSA-26-188-01.
Technical ContextAI
The affected component is the cloud/server-side backend for the Le Circuit Électrique EV charging network operated by Hydro-Québec, the system that charging stations authenticate against to authorize sessions and management operations. The root cause is CWE-307 (Improper Restriction of Excessive Authentication Attempts): the login/authentication path enforced no throttling, lockout, or backoff on repeated attempts. Without such controls, a client can submit unlimited authentication requests, which both enables high-volume request floods against the auth service and removes the standard brake against automated credential guessing. Because this is an operational-technology (OT/ICS) backend serving field charging equipment, availability of the backend directly affects the ability of stations to authorize charging.
RemediationAI
Because this is a vendor-hosted backend, the fix is applied server-side by Hydro-Québec: per the EUVD record the issue is resolved as of the June 2026 backend version, so operators should confirm their environment is on the June 2026 or later backend and require no client-side patching of field stations. Follow the guidance in CISA ICS advisory https://www.cisa.gov/news-events/ics-advisories/icsa-26-188-01 and the CSAF document at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-188-01.json, and contact the vendor via https://www.hydroquebec.com/nous-joindre/ for confirmation. As compensating controls where the fixed backend cannot be confirmed, enforce rate limiting and account lockout with exponential backoff on the authentication endpoint, place the endpoint behind a WAF or API gateway that caps requests-per-source and adds a CAPTCHA/challenge on repeated failures, and restrict backend auth reachability to known station IP ranges or a private network - noting the trade-off that aggressive lockout can itself deny service to legitimate stations and IP allow-listing must be maintained as the fleet changes.
Authentication bypass in the Hydro-Québec Le Circuit Électrique EV charging station backend lets remote unauthenticated
Backend resource exhaustion in Hydro-Québec's Le Circuit Electrique EV charging station backend (all versions prior to t
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today