Hydro-Québec vulnerabilities
Published CVEs affecting Hydro-Québec products: 3 record(s), with severity, exploitation and fixes.
CVE-2026-44383
High · 7.5
CWE-613 Jul 10, 2026
Hydro-Québec Le Circuit Electrique charging station backend Insufficient Session Expiration
Multiple connections to the backend using the same charging station ID
are allowed, which could allow an attacker to deploy multiple instances
of malicious OCPP clients to overwhelm the backend.
CVE-2026-42952
High · 7.5
CWE-307 Jul 10, 2026
Hydro-Québec Le Circuit Electrique charging station backend Improper Restriction of Excessive Authentication Attempts
Previously, there was no throttling on repeated authentication attempts
to the charging station backend, which could allow an attacker to
execute a denial-of-service attack.
CVE-2026-20744
Critical · 9.8
CWE-284 Jul 10, 2026
Hydro-Québec Le Circuit Electrique charging station backend Improper Access Control
The charging station websocket endpoint accepts connections without
proper authentication, which could lead to privilege escalation.