EUVD-2026-43096
GHSA-7wpg-27g9-f8vc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach backend OCPP WebSocket endpoint
-
DeliveryReuse or spoof valid station ID
-
ExploitOpen many duplicate sessions per ID
-
ExecutionBackend accepts concurrent rogue clients
-
PersistExhaust session/resource capacity
-
ImpactDeny service to legitimate stations
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V7 - Session Management Session expiration enforcement
|
| Exploitation Conditions | Exploitation requires the OCPP/WebSocket backend endpoint to be network-reachable and to accept multiple concurrent connections for the same charging station identifier - the specific weakness being that the backend does not reject or expire a duplicate session for an already-connected station ID (CWE-613). Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) there is no authentication, user interaction, or special attack requirement: an attacker only needs to reach the backend and reuse/spoof a valid station ID. Limiting factors are minimal - the main practical constraints are network reachability of the OCPP endpoint and knowledge or guessing of an accepted charging station ID; impact is confined to availability (VA:H) with no data exposure or manipulation. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H, all other impacts N) scores 8.7 and cleanly matches the description: fully remote, low complexity, no authentication or user interaction, with impact limited exclusively to availability - no confidentiality or integrity loss. This is a pure denial-of-service/resource-exhaustion issue, so the high score reflects ease of reach rather than data compromise. Countervailing signals lower real-world urgency: it is NOT in CISA KEV, no POC or exploit code was provided, and no EPSS probability was supplied, so there is no evidence of active or imminent exploitation. The tag 'Information Disclosure' conflicts with the CVSS vector (VC:N) and the description, which describe availability impact only - treat that tag as mislabeled and rely on the VA:H availability framing. Net: a genuine availability risk for the specific operator's platform, but scoped to a single regional backend rather than a widespread software product. |
| Exploit ScenarioDerived | An attacker script repeatedly opens OCPP WebSocket connections to the backend, each authenticating with the same (or spoofed) charging station ID that the backend accepts without rejecting the prior session. By scaling this to many concurrent malicious clients, the attacker consumes backend session and resource capacity until legitimate charging stations can no longer connect or transact. No exploit code is publicly identified, but the low-complexity, unauthenticated network vector (AV:N/AC:L/PR:N) makes this straightforward to script. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 10, 2026
Backend resource exhaustion in Hydro-Québec's Le Circuit Electrique EV charging station backend (all versions prior to the June 2026 fix) lets remote unauthenticated attackers open multiple simultaneous OCPP sessions under a single charging station identifier, flooding the platform with rogue clients. Because the backend never enforces one active session per station ID, an attacker can spin up many spoofed OCPP clients and exhaust backend capacity, degrading or denying service to legitimate charging stations. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.
Earlier versions of this analysis (2)
Backend resource exhaustion in Hydro-Québec's Le Circuit Électrique EV charging station backend (versions before June 2026) lets a remote unauthenticated attacker register multiple concurrent OCPP client connections under a single charging station ID, flooding the backend and degrading or denying service. Because the platform never rejects duplicate sessions for the same station identifier, an attacker can spin up many rogue OCPP clients to overwhelm backend capacity. Rated CVSS 4.0 8.7 (High) with a pure availability impact; no public exploit code and no CISA KEV listing were identified at time of analysis.
Backend availability disruption in Hydro-Québec's Le Circuit Électrique EV charging station backend allows remote unauthenticated attackers to open multiple simultaneous connections that reuse a single charging station ID, enabling resource exhaustion of the OCPP backend. Reported by ICS-CERT and published as CISA ICS advisory ICSA-26-188-01, the flaw carries CVSS 7.5 (availability-only impact) with no public exploit identified at time of analysis. Because no authentication is required, an attacker only needs to impersonate or spoof a station identifier to spin up many malicious OCPP client instances against the backend.
RemediationAI
Apply the vendor's June 2026 backend update, which per the EUVD version range ('<June_2026') is the release that fixes the duplicate-session flaw; because this is an operator-hosted backend, remediation is deployed by Hydro-Québec rather than by station owners, so confirm your platform is on the post-June-2026 build via the CISA advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-188-01. As compensating controls where patching is delayed: enforce one active OCPP session per charging station ID at the backend (drop or reject a new connection that duplicates an existing station ID, the direct fix for CWE-613), rate-limit and cap concurrent WebSocket connections per source and per station identifier, and require mutual TLS / client-certificate authentication for OCPP endpoints so unregistered clients cannot connect. Trade-offs: aggressively dropping duplicate sessions can disconnect a legitimately reconnecting station after a network blip (tune with a short grace/expiry window), and per-source rate limits may throttle stations sharing a NAT or aggregator gateway.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the cloud backend of Le Circuit Electrique, a Quebec EV-charging network operated by Hydro-Québec. Charging stations communicate with the backend using OCPP (Open Charge Point Protocol), which runs over persistent WebSocket connections keyed by a charging station identifier. The root cause is classified as CWE-613 (Insufficient Session Expiration): the backend fails to invalidate or reject a prior/duplicate session when the same station ID connects again, so multiple concurrent sessions can coexist for one identifier. The single affected product per CPE is cpe:2.3:a:hydro-québec:le_circuit_electrique_charging_station_backend, all builds before the June 2026 release.
Know when Le Circuit Electrique Charging Station Backend gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote, low-complexity, unauthenticated OCPP session abuse with no user interaction; impact is availability-only (A:H) with no confidentiality or integrity effect and no scope change.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
3DescriptionCVE.org
Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend.
Executive ViewAI
Hydro-Québec's Le Circuit Electrique charging backend is vulnerable to remote denial-of-service attacks from unauthenticated actors who can flood the system with spoofed charging sessions, rendering public stations inaccessible. This critical infrastructure gap threatens customer availability and business continuity for Quebec's largest EV charging network.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement rate limiting to restrict OCPP session creation per charging station ID; (2) Add per-session timeout to reclaim backend resources; (3) Deploy connection limits per source IP at network perimeter; (4) Enable continuous monitoring for abnormal session pattern deviations with automatic alerting; (5) Configure graceful degradation at load balancer to preserve service for critical stations under attack; (6) Stage geographic isolation to contain blast radius if DoS occurs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Authentication bypass in the Hydro-Québec Le Circuit Électrique EV charging station backend lets remote unauthenticated
Denial-of-service exposure in the Hydro-Québec Le Circuit Électrique EV charging-station backend allows remote, unauthen
Exploit-DB