ABB Protection and Control IED Manager PCM600: 2 CVEs, Medium 6.4
Summary
CISA reports 2 vulnerabilities in ABB Protection and Control IED Manager PCM600. Weakness types: Incorrect Permission Assignment for Critical Resource, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges or overwrite files. Highest CVSS v3 score: 6.4 (Medium), not remotely exploitable per its CVSS vector.
At a glance
- Vendor
- ABB
- Products
- Protection and Control IED Manager PCM600
- CVEs
- CVE-2026-15952, CVE-2026-15953
- Highest CVSS v3
- 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Energy
- Deployed
- Worldwide
- Vendor HQ
- Switzerland
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-15952 | Incorrect Permission Assignment for Critical Resource | 6.4 | – | No | A vulnerability exists in the Scheduler Service installed with PCM600. The service executes under the LocalSystem account while permissions are granted to standard PCM600 users through membership in the local users group. An attacker with local access and valid user credentials may exploit this vulnerability to elevate privileges and obtain control of the affected host. |
| CVE-2026-15953 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 5.0 | – | No | A vulnerability exists in the processing of PCM600 project archives files. Insufficient validation of archive entry paths may permit path traversal during extraction, potentially allowing files to be written to loca tions outside the intended extraction directory. |
Affected products (1)
- ABB Protection and Control IED Manager PCM600: <=2.14
Vendor fixes and mitigations (from advisory)
- Mitigation: ABB recommends the following workaround. Although this workaround does not correct the underlying vulnerability, it reduces the risk of privilege escalation.
- Mitigation: Configure the appropriate ABBPCMSchedulerService instance to run using the same Windows account that is used to operate PCM600:
- Mitigation: Open Services.msc.
- Mitigation: Locate the ABBPCMSchedulerService corresponding to the installed PCM600 version.
- Mitigation: Open Properties and select the Log On tab.
- Mitigation: The service should be configured to log on with the same Windows user account that is used for the PCM600 application.
- Mitigation: Ensure that this account has the required "Log on as a service" privilege.
- Mitigation: When authentication is enabled for the IED, the Scheduler tool must be used with the same Windows account configured as the Scheduler Service logon account.
- Mitigation: For installations using IED security certificates, the PCM600 setting Always trust IED security certifcates must be enabled only when PCM600-to-IED communication takes place in a secure and trusted environment.
- Mitigation: For more information, see ABB security advisory 2NGA003170 and 2NGA003179.
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.