A vulnerability in the Hydro-Québec charging station backend allows unauthenticated attackers to overwhelm the system by reusing charging station identifiers.

The system suffers from a session handling flaw (CWE-613) where it fails to properly invalidate or restrict multiple concurrent connections using the same charging station ID. This allows an unauthenticated attacker to inject malicious OCPP clients, leading to backend resource exhaustion.

This vulnerability poses a significant risk to the availability of the charging station network. Successful exploitation could result in service disruption for legitimate users, causing reputational damage to the service provider and potential operational downtime. The CVSS score of 7.5 (High) reflects the high impact on system availability, even though confidentiality and integrity remain unaffected.

Immediate Action: Upgrade the affected backend systems to the version released in June 2026 or later as specified by Hydro-Québec.

Proactive Monitoring: Monitor backend logs for anomalous connection patterns, specifically multiple concurrent sessions originating from the same charging station ID.

Compensating Controls: Implement rate limiting and stricter session validation at the network edge or via a Web Application Firewall (WAF) to prevent unauthorized concurrent connections.

Public Exploit Available: False

The high severity of this vulnerability, combined with its impact on critical infrastructure, necessitates immediate attention. Administrators must verify their deployment status against the June 2026 update and apply the vendor-provided fixes to ensure the continued availability and integrity of the charging station network.