ABB Protection and Control IED Manager (PCM600) - PCM600 Project Import Path Traversal

MonitorCVSS 52nga003179Sep 28, 2026

ABB

Attack path

Attack VectorLocal

Auth RequiredLow

ComplexityLow

User InteractionRequired

Summary

ABB PCM600 project import functionality contains a path traversal vulnerability in archive entry path validation. A specially crafted PCM600 project archive may allow an attacker to create or overwrite files outside the intended extraction directory using the permissions of the importing user. The vulnerability affects PCM600 versions 2.14 and earlier. ABB has released a hotfix (2.14 Hotfix 20260923) that resolves the issue. Configuring PCM600 with High Security Level mitigates the risk by rejecting unsigned project imports.

What this means

What could happen

An attacker could craft a malicious PCM600 project file that, when imported by an authorized user, overwrites or creates arbitrary files on the engineering workstation with that user's permissions, potentially compromising the integrity of control system configurations or the workstation itself.

Who's at risk

Engineering and operations staff at utilities and manufacturing facilities who use ABB PCM600 for protection and control IED configuration and management. This affects protection relays, power distribution automation, and substation control systems that depend on PCM600 for device programming and parameter management.

How it could be exploited

An attacker creates a specially crafted PCM600 project archive with malicious paths that exploit insufficient validation during import. When an engineering user imports this archive into PCM600, the path traversal allows files to be written outside the intended directory. The attacker must trick or socially engineer the user into importing the malicious project file.

Prerequisites

Local or network access to the PCM600 workstation
User with permissions to import PCM600 projects (typically engineering/configuration staff)
User must import a malicious project archive (social engineering or supply chain attack required)

local exploitation requiredrequires user interactionpath traversal can overwrite critical configuration fileslow attack complexity

Exploitability

Unlikely to be exploited — EPSS score 0.1%

Affected products (1)

ProductAffected VersionsFix Status

Protection and control IED manager PCM600 <=2.14≤ 2.142.14 Hotfix 20260923

Remediation & Mitigation

0/3

Do now

0/2

HARDENINGConfigure PCM600 with High Security Level to enforce signature verification and reject unsigned project imports

HARDENINGRestrict project imports to archives from verified and trusted sources only; implement a review process before importing any external project files

Schedule — requires maintenance window

0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate PCM600 to version 2.14 Hotfix 20260923 or later via the ABB Update Manager

CVEs (1)

CVE-2026-15953

View full ABB PSIRT advisory

↑↓ Navigate · Esc Close

API: /api/v1/advisories/e5add449-a61a-4d38-9a1a-47b4e943a7ee

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.