Le Circuit Électrique EUVD-2026-43095

No special conditions - remote unauthenticated exploitation against the authentication endpoint of the Le Circuit Électrique charging-station backend, per CVSS AV:N/AC:L/AT:N/PR:N/UI:N. The specific prerequisite is network reachability of the backend authentication interface, which the attacker abuses because it enforces no throttling, lockout, or backoff on repeated attempts (CWE-307). The main limiting factor is that this is a single vendor-operated cloud backend rather than widely distributed software, so exploitation targets one operator's infrastructure; additionally, only backend versions prior to the June 2026 fix are vulnerable, and any upstream rate limiting, WAF, or network access restriction in front of the endpoint would blunt the attack.

Signals are moderately strong but internally inconsistent, and this should be flagged. The CVSS 4.0 vector is fully remote and unauthenticated with low complexity (AV:N/AC:L/AT:N/PR:N/UI:N), which supports the high score of 8.7. However, the published vector encodes the impact as VI:H (integrity high) with VC:N and VA:N, while the human-readable description explicitly says the outcome is a denial-of-service - a discrepancy, since a DoS is normally an availability (VA) impact, not integrity. The associated tag also reads 'Information Disclosure,' which matches neither the DoS description nor the CWE-307 root cause. No EPSS score was provided, it is not in CISA KEV, and no POC is referenced, so there is no evidence of active or automated exploitation despite the high base score. Net assessment: the missing-throttling weakness is real and trivially reachable, but the concrete worst-case impact is ambiguous in the source data; treat it as a genuine remote DoS/brute-force-enabler priority for the operator while verifying the true impact (availability vs. integrity vs. disclosure) with Hydro-Québec/CISA before over- or under-prioritizing.

A remote attacker with no credentials scripts a high rate of authentication requests against the charging-station backend's login endpoint; because no throttling exists, the requests are accepted indefinitely, exhausting authentication resources and preventing legitimate stations from authorizing charging sessions. The same lack of throttling would also permit unlimited automated credential guessing. No public exploit is identified at time of analysis, but the low attack complexity means only basic scripting is required.