The Hydro-Québec Le Circuit Electrique charging station backend permits multiple concurrent connections using the same charging station identifier. This design flaw corresponds to CWE-613, indicating insufficient session expiration or management controls. An attacker could exploit this by deploying multiple malicious OCPP clients that use the same station ID to flood or overwhelm the backend service. The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and an impact limited to availability disruption. There is no vendor advisory or patch information available at this time.

The vulnerability can lead to denial of service conditions by overwhelming the backend system with multiple connections from malicious clients using the same charging station ID. This impacts the availability of the charging station backend service. Confidentiality and integrity are not affected according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitoring for abnormal connection patterns and limiting concurrent connections per charging station ID could be considered as temporary mitigations, but no vendor guidance is provided.