CISA ICSA-26-188-01: Hydro-Quebec Charging Station Backend Vulnerabilities (CVE-2026-20744, 42952, 44383)

Vulnerability Overview Vulnerability Name: Hydro-Québec Le Circuit Electrique charging station backend Publication Date: July 7, 2026 Alert Code: ICSA-26-188-01 Related Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Impact Scope Affected Versions: Hydro-Québec Le Circuit Electrique charging station backend v3 9.8 CVSS Score: 9.8 Vendor: Hydro-Québec Device: Hydro-Québec Le Circuit Electrique charging station backend Vulnerability Types: - Inadequate Access Control - Inadequate Restriction of Overly Many Authentication Attempts - Insufficient Session Expiration Remediation Recommended Practices: - Minimize network exposure by ensuring that all control system devices and/or systems are not accessible from the Internet. - Place control system networks and remote devices behind firewalls and isolate them from the business network. - Use more secure remote access methods, such as Virtual Private Networks (VPN), and ensure that the VPN is updated to the latest version. - Conduct appropriate impact analysis and risk assessment to deploy defensive measures. - Implement recommended cybersecurity policies to proactively defend ICS assets. - Follow internal procedures to report suspicious malicious activity and notify CISA for tracking and correlation analysis. Vulnerability Details CVE IDs: - CVE-2026-20744 - CVE-2026-42952 - CVE-2026-44383 Background Information Critical Infrastructure Sector: Transportation Systems Deployed Country/Region: Canada Company Headquarters Location: Canada Acknowledgments Reporter: An anonymous researcher reported these vulnerabilities to CISA. Revision History Initial Publication Date: July 7, 2026 Revision Version: 1 Summary: Initial Release Tags Sector: Transportation Systems Sector Topic: Industrial Control System Vulnerabilities, Industrial Control Systems Related Links Related Alerts: - Schneider Electric Easergy MiCOM Px40 Series - OpenPLC v3 - Schneider Electric PowerChute Serial Shutdown - Siemens Mendix Studio Pro Legal Notice and Terms of Use This product is subject to this notice and the Privacy and Use Policy. Feedback Please share your thoughts; we have recently updated our anonymous product survey and welcome your feedback. Additional Information CISA Central Contact: 1-844-Say-CISA, contact@cisa.dhs.gov Official Website: CISA.gov, the official website of the U.S. Department of Homeland Security The above is a summary of key vulnerability information from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

CISA ICSA-26-188-01: Hydro-Quebec Charging Station Backend Vulnerabilities (CVE-2026-20744, 42952, 44383)