EUVD-2026-43096
GHSA-7wpg-27g9-f8vc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, low-complexity, unauthenticated OCPP session abuse with no user interaction; impact is availability-only (A:H) with no confidentiality or integrity effect and no scope change.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
5DescriptionCVE.org
Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend.
AnalysisAI
Backend resource exhaustion in Hydro-Québec's Le Circuit Electrique EV charging station backend (all versions prior to the June 2026 fix) lets remote unauthenticated attackers open multiple simultaneous OCPP sessions under a single charging station identifier, flooding the platform with rogue clients. Because the backend never enforces one active session per station ID, an attacker can spin up many spoofed OCPP clients and exhaust backend capacity, degrading or denying service to legitimate charging stations. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.
Technical ContextAI
The affected component is the cloud backend of Le Circuit Electrique, a Quebec EV-charging network operated by Hydro-Québec. Charging stations communicate with the backend using OCPP (Open Charge Point Protocol), which runs over persistent WebSocket connections keyed by a charging station identifier. The root cause is classified as CWE-613 (Insufficient Session Expiration): the backend fails to invalidate or reject a prior/duplicate session when the same station ID connects again, so multiple concurrent sessions can coexist for one identifier. The single affected product per CPE is cpe:2.3:a:hydro-québec:le_circuit_electrique_charging_station_backend, all builds before the June 2026 release.
RemediationAI
Apply the vendor's June 2026 backend update, which per the EUVD version range ('<June_2026') is the release that fixes the duplicate-session flaw; because this is an operator-hosted backend, remediation is deployed by Hydro-Québec rather than by station owners, so confirm your platform is on the post-June-2026 build via the CISA advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-188-01. As compensating controls where patching is delayed: enforce one active OCPP session per charging station ID at the backend (drop or reject a new connection that duplicates an existing station ID, the direct fix for CWE-613), rate-limit and cap concurrent WebSocket connections per source and per station identifier, and require mutual TLS / client-certificate authentication for OCPP endpoints so unregistered clients cannot connect. Trade-offs: aggressively dropping duplicate sessions can disconnect a legitimately reconnecting station after a network blip (tune with a short grace/expiry window), and per-source rate limits may throttle stations sharing a NAT or aggregator gateway.
Authentication bypass in the Hydro-Québec Le Circuit Électrique EV charging station backend lets remote unauthenticated
Denial-of-service exposure in the Hydro-Québec Le Circuit Électrique EV charging-station backend allows remote, unauthen
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today