CISA 2026-07-07

Hydro-Québec Le Circuit Electrique charging station backend

Machine-generated analysis · WAYSCloud LLM

The advisory states that affected charging station backends allowed unauthenticated websocket connections, potentially enabling privilege escalation.

Context

The affected product is the Hydro-Québec Le Circuit Electrique charging station backend, used in Canada's transportation systems. The advisory identifies improper access control and lack of authentication attempt throttling as key vulnerabilities. Notably, Hydro-Québec has mitigated risk by disabling OCPP on most stations and adding authentication for those still using it. The CVSS scores are high, with versions 3.1 and 4.0 rating 9.8 and 9.3 respectively.

Operator considerations

Check: Determine if any Le Circuit Electrique charging station backends are in use and verify their version status.
Patch: Contact Hydro-Québec for updates if the backend version is prior to June_2026.
Log: Monitor for unauthenticated websocket connection attempts if OCPP remains enabled.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of these vulnerabilities could lead to privilege escalation, or result in a denial-of-service attack.

The following versions of Hydro-Québec Le Circuit Electrique charging station backend are affected:

Le Circuit Electrique charging station backend

Vendor

Equipment

Hydro-Québec

Hydro-Québec Le Circuit Electrique charging station backend

Improper Access Control, Improper Restriction of Excessive Authentication Attempts, Insufficient Session Expiration

Critical Infrastructure Sectors: Transportation Systems

Countries/Areas Deployed: Canada

Company Headquarters Location: Canada

The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation.

Hydro-Québec Le Circuit Electrique charging station backend

Read the full advisory on CISA →