PT-2026-57340 · Hydro Québec · Le Circuit Electrique Charging Station Backend

Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-44383

Mitre

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-44383

Affected Products

Le Circuit Electrique Charging Station Backend

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-44383 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-188-01.json · Note
• https://hydroquebec.com/nous-joindre · Note
• https://cisa.gov/news-events/ics-advisories/icsa-26-188-01 · Note