The Hydro-Québec Le Circuit Electrique charging station backend lacks throttling controls on repeated authentication attempts, which can be exploited to cause a denial-of-service condition. This vulnerability corresponds to CWE-307, indicating improper restriction of excessive authentication attempts. The CVSS v3.1 base score is 7.5, reflecting a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to integrity but not availability or confidentiality. No vendor advisory or patch information is currently available, and the product is not a cloud service.

An attacker can exploit this vulnerability by repeatedly attempting authentication without restriction, potentially causing a denial-of-service condition on the charging station backend. This could disrupt normal operations by impacting the integrity of the authentication process. There is no indication of confidentiality or availability impact beyond the denial-of-service potential. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing external throttling or rate-limiting controls on authentication attempts at the network or application layer to mitigate potential denial-of-service attacks. Monitor for updates from Hydro-Québec regarding official remediation.