As reported by CISA in advisory ICSA-26-188-01, critical vulnerabilities have been disclosed in the backend systems powering Hydro-Québec's Le Circuit Electrique electric vehicle charging network — one of Canada's most prominent public EV charging infrastructures. With a CVSS v3 score of 9.8 (Critical), these findings demand immediate attention from operators, utilities, and transportation sector security teams.
Vulnerability Summary
- CVE-2026-20744
- Improper Access Control — The charging station WebSocket endpoint accepts connections without proper authentication, enabling unauthenticated actors to potentially escalate privileges and take control of charging station management functions.
- Additional Flaws (No Separate CVEs Listed)
- Improper Restriction of Excessive Authentication Attempts (brute-force exposure) and Insufficient Session Expiration — both enabling persistent unauthorized access once initial foothold is achieved.
| Field | Details |
|---|---|
| Vendor | Hydro-Québec |
| Product | Le Circuit Electrique Charging Station Backend |
| CVSS v3 Score | 9.8 — Critical |
| Primary CVE | CVE-2026-20744 |
| Vulnerability Types | Improper Access Control, Brute Force (Excessive Auth Attempts), Insufficient Session Expiration |
| Affected Sector | Transportation Systems (Critical Infrastructure) |
| Geography | Canada |
| Known Active Exploitation | Not confirmed at time of advisory |
| Patch Available | Refer to CISA advisory ICSA-26-188-01 and Hydro-Québec for remediation guidance |
Why This Is More Serious Than It Appears
On the surface, a vulnerability in EV charging software may seem like a niche concern. The reality is significantly more alarming. EV charging backend platforms represent a convergence point between operational technology (OT), the public internet, and grid-connected energy systems. When authentication is entirely absent from a WebSocket endpoint — as described in CVE-2026-20744 — an attacker doesn't need to crack a password or exploit a complex chain of flaws. They simply connect and operate.
This class of vulnerability in ICS/OT environments is particularly dangerous because the attack surface is externally reachable, the blast radius extends to physical infrastructure, and remediation often requires coordinated downtime across distributed hardware assets — chargers that may number in the thousands across a national network.
An unauthenticated WebSocket endpoint in critical infrastructure isn't a misconfiguration — it's an open door. The CVSS 9.8 rating reflects that no special access, credentials, or user interaction is required to begin exploitation.
Broader Implications for EV Infrastructure Security
The EV charging sector is growing rapidly across North America and Europe, often outpacing the security maturity of the platforms supporting it. Many charging backends were architected for connectivity and scalability — not adversarial resilience. The combination of vulnerabilities disclosed here — missing authentication, no brute-force throttling, and sessions that never expire — reflects a pattern Shield53 regularly observes in first-generation ICS-connected web platforms: security was an afterthought to deployment velocity.
Nation-state actors with interest in disrupting Canadian energy or transportation systems, as well as financially motivated threat actors seeking to manipulate billing or disable charging availability, should be considered realistic threat profiles here. Denial-of-service impact on EV charging networks could have cascading effects on EV adoption trust and emergency vehicle operations in regions with high electrification rates.
Who Is at Risk
Shield53 Recommendations — Immediate Actions
- Apply vendor patches immediately. Contact Hydro-Québec's security team and monitor the CISA advisory (ICSA-26-188-01) for patch releases. Do not wait for a scheduled maintenance window given the 9.8 CVSS score.
- Isolate the WebSocket endpoint. If patching is not immediately possible, restrict access to the charging station WebSocket interface via network-layer controls — allowlist known IP ranges and enforce mutual TLS.
- Audit active sessions. Given the Insufficient Session Expiration flaw, force-invalidate all current sessions and implement session timeout policies as an interim measure.
- Enable authentication rate limiting. Implement account lockout or CAPTCHA mechanisms at the API gateway level to mitigate brute-force exposure while the underlying code is remediated.
- Deploy anomaly detection on WebSocket traffic. Monitor for unexpected connection sources, high-frequency authentication attempts, or unusual command patterns against the charging management interface.
- Conduct a full authentication audit. Any organization running EV charging backend infrastructure should review all externally accessible endpoints for authentication enforcement — this disclosure is likely symptomatic of broader architectural gaps in the sector.
Shield53 will continue monitoring for proof-of-concept activity or exploitation reports related to CVE-2026-20744. Given the public disclosure and critical severity, organizations should treat this as actively exploitable until patched.
