CVE-2026-42952

Hydro-Québec Le Circuit Electrique charging station backend Improper Restriction of Excessive Authentication Attempts

Published Jul 10, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

Previously, there was no throttling on repeated authentication attempts
to the charging station backend, which could allow an attacker to
execute a denial-of-service attack.

Analysis

Technical impact

The vulnerability is the absence of throttling on repeated authentication attempts to Hydro‑Québec’s Le Circuit Electrique charging station backend, allowing an attacker to consume resources and trigger a denial‑of‑service, consistent with the identified CWE‑307.

Affected Systems

It affects Hydro‑Québec’s Le Circuit Electrique charging station backend. Specific firmware or hardware revisions are not disclosed, but Hydro‑Québec has released updates for most stations that disable OCPP or add authentication safeguards.

Risk and Exploitability

The CVSS score is 8.7, the EPSS score is less than 1%, and the vulnerability is not listed in CISA’s KEV catalog. The lack of throttling permits repeated authentication attempts over the OCPP interface or another network channel, potentially exhausting backend resources. Hydro‑Québec’s official solution—disabling OCPP or implementing authentication controls—removes the main exploitation path.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Hydro-Québec

Le Circuit Electrique charging station backend

unaffected

Version	Status	Constraints
`0`	affected	< June_2026

No data.

Vendor Product Versions

Hydro-québec

Le Circuit Electrique Charging Station Backend

Version	Status	Scheme	Platform
`[0,June_2026)`	affected	generic	—

Remediation

Vendor Solution

Hydro-Québec has updated the majority of charging stations to disable OCPP, mitigating the risk of exploitation. Hydro-Québec has also implemented authentication systems to mitigate the issue for certain charging stations which are still reliant on OCPP. Contact Hydro-Québec with any additional questions.

OpenCVE Recommended Actions

Install Hydro‑Québec–issued firmware updates that disable OCPP or add authentication safeguards to the charging stations.
If stations have not been updated, contact Hydro‑Québec for guidance and consider applying temporary network controls such as firewall restrictions or IP whitelisting to block repeated authentication attempts.
Monitor authentication traffic for rapid repeat attempts and configure alerts to detect possible brute‑force or denial‑of‑service attempts.

Generated by OpenCVE AI on August 3, 2026 at 03:56 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.537% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-188-01.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-188-01
https://www.hydroquebec.com/nous-joindre/

History

Jul 14, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 13, 2026 3:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Hydro-québec Hydro-québec le Circuit Electrique Charging Station Backend
Vendors & Products		Hydro-québec Hydro-québec le Circuit Electrique Charging Station Backend

Jul 10, 2026 10:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Previously, there was no throttling on repeated authentication attempts to the charging station backend, which could allow an attacker to execute a denial-of-service attack.
Title		Hydro-Québec Le Circuit Electrique charging station backend Improper Restriction of Excessive Authentication Attempts
Weaknesses		CWE-307
References		https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-188-01.json https://www.cisa.gov/news-events/ics-advisories/icsa-26-188-01 https://www.hydroquebec.com/nous-joindre/
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}`