Hydro-Québec Charging Station Vulnerabilities Highlight Critical Infrastructure Risks
Executive Summary
In July 2026, Hydro-Québec's Le Circuit Electrique charging station backend was found to have multiple critical vulnerabilities, including improper access control, insufficient session expiration, and lack of throttling on authentication attempts. These flaws could allow attackers to escalate privileges or execute denial-of-service attacks, potentially disrupting electric vehicle charging services across Canada. Hydro-Québec has since updated the majority of charging stations to disable the Open Charge Point Protocol (OCPP) and implemented authentication systems to mitigate these risks.
This incident underscores the growing cybersecurity challenges in the electric vehicle infrastructure sector. As the adoption of EVs accelerates, ensuring the security of charging networks becomes paramount to prevent potential disruptions and maintain public trust in sustainable transportation solutions.
Why This Matters Now
The vulnerabilities in Hydro-Québec's charging station backend highlight the urgent need for robust cybersecurity measures in critical infrastructure. With the rapid expansion of electric vehicle adoption, securing charging networks is essential to prevent service disruptions and protect user data.
Attack Path Analysis
An attacker exploited the WebSocket backend's improper access control to establish unauthorized connections using predictable charging station identifiers. This allowed the attacker to escalate privileges by hijacking legitimate sessions and intercepting backend commands. Subsequently, the attacker moved laterally within the network by leveraging the compromised sessions to access other connected systems. They established command and control by maintaining persistent access through the hijacked WebSocket connections. The attacker exfiltrated sensitive data by intercepting communications between the charging stations and the backend. Finally, the attacker impacted the system by causing denial-of-service conditions through overwhelming the backend with multiple connections using valid session identifiers.
Kill Chain Progression
Initial Compromise
Description
Exploited the WebSocket backend's improper access control to establish unauthorized connections using predictable charging station identifiers.
Related CVEs
CVE-2026-20744
CVSS 9.8The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation.
Affected Products:
Hydro-Québec Le Circuit Electrique charging station backend – <June_2026
Exploit Status:
no public exploitCVE-2026-42952
CVSS 7.5Previously, there was no throttling on repeated authentication attempts to the charging station backend, which could allow an attacker to execute a Denial-of-Service attack.
Affected Products:
Hydro-Québec Le Circuit Electrique charging station backend – <June_2026
Exploit Status:
no public exploitCVE-2026-44383
CVSS 7.5Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend.
Affected Products:
Hydro-Québec Le Circuit Electrique charging station backend – <June_2026
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Valid Accounts
Brute Force
Network Denial of Service
Application Layer Protocol
External Remote Services
Modify Authentication Process
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Limit repeated access attempts
Control ID: 8.3.6
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Identity and Access Management
Control ID: 3.1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Utilities
Electric vehicle charging infrastructure vulnerabilities expose critical utility networks to privilege escalation, denial-of-service attacks, and potential grid disruption through compromised OCPP protocols.
Automotive
EV charging station backend vulnerabilities threaten automotive ecosystem reliability, potentially disrupting charging networks and compromising vehicle-to-infrastructure communication systems across transportation networks.
Transportation
Critical transportation infrastructure faces service disruption risks from unauthenticated websocket connections and session management flaws in electric vehicle charging station backends.
Oil/Energy/Solar/Greentech
Energy sector charging infrastructure vulnerabilities enable attackers to overwhelm backend systems, potentially disrupting clean energy adoption and electric mobility transition initiatives.
Sources
- Hydro-Québec Le Circuit Electrique charging station backendhttps://www.cisa.gov/news-events/ics-advisories/icsa-26-188-01Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it would likely limit unauthorized access and lateral movement within the network, thereby reducing the attacker's ability to escalate privileges and exfiltrate sensitive data.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to establish unauthorized connections may have been constrained, reducing the likelihood of initial compromise.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges may have been constrained, reducing the scope of unauthorized access.
Control: East-West Traffic Security
Mitigation: The attacker's ability to move laterally within the network may have been constrained, reducing the reach of the attack.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to maintain persistent access may have been constrained, reducing the duration of unauthorized control.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate sensitive data may have been constrained, reducing the risk of data loss.
The attacker's ability to cause denial-of-service conditions may have been constrained, reducing the impact on system availability.
Impact at a Glance
Affected Business Functions
- Charging Station Operations
- Customer Billing
- System Monitoring
Estimated downtime: 3 days
Estimated loss: $50,000
Potential exposure of operational data related to charging station usage and customer information.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to enforce least privilege access and prevent unauthorized lateral movement.
- • Deploy East-West Traffic Security controls to monitor and restrict internal communications, mitigating lateral movement risks.
- • Utilize Threat Detection & Anomaly Response systems to identify and respond to unauthorized session hijacking attempts.
- • Apply Egress Security & Policy Enforcement to control outbound traffic and prevent data exfiltration.
- • Ensure proper session management and authentication mechanisms to prevent session hijacking and unauthorized access.
