CVE-2026-20744: CVE-2026-20744: Improper Access Control in Le Circuit Électrique Charging Station Backend

#security #cve #cybersecurity

CVE-2026-20744: Improper Access Control in Le Circuit Électrique Charging Station Backend

Vulnerability ID: CVE-2026-20744
CVSS Score: 9.8
Published: 2026-07-10

A critical improper access control vulnerability (CWE-284) in the WebSocket upgrade endpoint of Le Circuit Électrique charging station backend allows remote, unauthenticated attackers to connect to the Charging Station Management System and impersonate charging stations.

TL;DR

Unauthenticated WebSocket connection upgrade allows remote attackers to impersonate EV charging stations, spoof transactions, and disrupt critical grid infrastructure.

Technical Details

CWE ID: CWE-284
Attack Vector: Network
CVSS Severity Score: 9.8 (Critical)
EPSS Score: 0.00519 (Percentile: 40.63%)
Primary Impact: Privilege Escalation and Charging Station Impersonation
Exploit Status: None (No public PoC or active exploitation)
CISA KEV Status: Not Listed

Affected Systems

Hydro-Québec Le Circuit Électrique charging station backend
Le Circuit Électrique charging station backend: < June 2026 (Fixed in: June 2026 Update)

Mitigation Strategies

Disable unnecessary OCPP interfaces globally.
Enforce Mutual TLS (mTLS) with client certificate verification.
Implement Basic/Bearer token validation within WebSocket handshake headers.
Isolate CSMS communications within cellular private APNs.

Remediation Steps:

Identify all active OCPP WebSocket endpoints configured on the CSMS backend.
Enforce client-certificate validation at the network load balancer or reverse proxy level.
Update CSMS connection logic to map and verify certificate Common Names (CN) against requested ChargePointIds.
Isolate the management network and restrict inbound traffic to known, registered charging nodes only.