CISA flags Hydro-Québec EV charging backend flaws
The scary part is not EV chargers; it is unauthenticated OCPP plumbing sitting close enough to transportation infrastructure to matter.
TL;DR
CISA published ICSA-26-188-01 for three vulnerabilities in Hydro-Québec's Le Circuit Electrique charging station backend affecting versions before June 2026. CVE-2026-20744 carries a CVSS 3.1 score of 9.8 and could allow privilege escalation through improperly authenticated WebSocket connections; two denial-of-service flaws score 7.5. Operators, managed service providers and public-sector CISOs should verify whether remaining OCPP-dependent stations have Hydro-Québec's authentication mitigations or have disabled OCPP.
CISA's July 7 advisory puts a hard security label on a familiar EV charging problem: the backend is not just a billing convenience. Hydro-Québec's Le Circuit Electrique charging station backend, in versions before June 2026, is affected by improper access control, insufficient throttling of authentication attempts and insufficient session expiration. The first flaw, CVE-2026-20744, lets the charging station WebSocket endpoint accept connections without proper authentication and carries a CVSS 3.1 score of 9.8. The other two, CVE-2026-42952 and CVE-2026-44383, could enable denial-of-service attacks against the backend.
Hydro-Québec's mitigation is narrower than a clean patch story. CISA says the utility has updated the majority of charging stations to disable Open Charge Point Protocol, or OCPP, and has implemented authentication systems for certain charging stations still reliant on OCPP. That is useful, but it leaves the operational question in the place practitioners hate: which stations are still in the exception bucket, and on what timetable do they leave it?
This is also not an isolated protocol footnote. CISA has issued several 2026 advisories for charging backends where unauthenticated or weakly controlled OCPP WebSocket endpoints could allow unauthorized administrative control or service disruption, including Everon, CTEK, IGL-Technologies, EV Energy and Chargemap systems (https://www.cisa.gov/news-events/ics-advisories/icsa-26-062-08; https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-06; https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-07; https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-07; https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-05). The pattern matters more than the brand name: station identifiers, WebSocket access and backend trust decisions keep turning into control-plane risk.
For operators and state CISOs, Monday's work is not exotic. Inventory Le Circuit Electrique deployments, confirm whether OCPP is disabled or authenticated, keep control-system assets off the public internet, and separate charging infrastructure from business networks. CISA says it has no reports of public exploitation targeting these vulnerabilities. That is not the same as saying legacy OCPP exposure is safe to carry indefinitely.
Published ·Deep Fathom