Vulnerability · Published Jul 10, 2026 · Assigned by icscert
CVE-2026-44383Hydro-Québec Le Circuit Electrique charging station backend Insufficient Session Expiration
High 7.5
In plain English
A high-severity security flaw in Le Circuit Electrique charging station backend from Hydro-Québec. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 53.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hydro-Québec | Le Circuit Electrique charging station backend | 0 – before June_2026 |
Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H