CVE-2026-44383CWE-613

Hydro-Québec Le Circuit Electrique charging station backend Insufficient Session Expiration

High · published July 10, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
46.1
In the wild
Unconfirmed
What it is

Multiple connections to the backend using the same charging station ID

are allowed, which could allow an attacker to deploy multiple instances

of malicious OCPP clients to overwhelm the backend.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00563 · 46.1th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-07-10T22:11Z
EPSS history
Timeline
  • 10 JUL 22:11Z
    Hydro-Québec Le Circuit Electrique charging station backend Insufficient Session Expiration
    cvelistv5