The Hydro-Québec Le Circuit Electrique charging station backend lacks throttling controls on repeated authentication attempts, which constitutes an improper restriction of excessive authentication attempts (CWE-307). This flaw could be exploited by an attacker to cause a denial-of-service condition by repeatedly attempting authentication, potentially disrupting service availability. The CVSS v3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. There is currently no vendor-provided patch or remediation guidance available, and the vulnerability is not known to be exploited in the wild.

An attacker can exploit the absence of throttling on authentication attempts to execute a denial-of-service attack against the charging station backend. This could disrupt the integrity of the authentication process and potentially impact the service's normal operation by overwhelming the backend with repeated authentication requests. There is no reported impact on confidentiality or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing external rate limiting or monitoring mechanisms to detect and mitigate excessive authentication attempts. Avoid actions that contradict vendor guidance once it is published.