OTPulse

ABB Protection and Control IED Manager PCM600

MonitorCVSS 6.4ICS-CERT ICSA-26-274-03Sep 28, 2026
ABB
Attack path
Attack VectorLocal
Auth RequiredHigh
ComplexityHigh
User InteractionNone needed
Summary

A local authenticated user in the PCM600 user group can modify the configuration of the ABBPCMSchedulerService Windows service, which runs with SYSTEM privileges. By changing the service binary path or parameters, the user could execute arbitrary commands with elevated privileges. The vulnerability affects PCM600 version 2.14 and earlier; ABB has not released a patch and recommends running the Scheduler Service under the same user account as the PCM600 application instead of SYSTEM.

What this means
What could happen
A local authenticated user in the PCM600 group could run arbitrary commands with SYSTEM-level privileges on the engineering workstation, potentially allowing modification of device configurations or disruption of control logic management across multiple networked IEDs.
Who's at risk
Engineering teams and operations staff who use ABB PCM600 to manage, configure, and schedule activities on protection and control Intelligent Electronic Devices (IEDs) in substations or generation facilities. This affects any organization running PCM600 version 2.14 or earlier on Windows engineering workstations.
How it could be exploited
An attacker with a user account in the PCM600 local group can modify the Windows service configuration of ABBPCMSchedulerService (which runs as SYSTEM) through the Services management interface. By changing the service binary path or startup parameters, the attacker can execute arbitrary commands with SYSTEM privileges the next time the service starts or is triggered by the Scheduler tool.
Prerequisites
  • Local user account membership in PCM600 user group
  • Windows logon access to the PCM600 engineering workstation
  • Services.msc management access (available to domain users on workstations by default)
Local exploitation requiredHigh complexity to exploitHigh privileges required for initial accessNo vendor patch availableAffects engineering workstations managing critical control devicesLow impact on confidentiality and integrity per vendor severity rating
Exploitability
Unlikely to be exploited — EPSS score 0.1%
Affected products (2)
2 pending
ProductAffected VersionsFix Status
Protection and control IED manager PCM600 <=2.14≤ 2.14No fix yet
Protection and Control IED Manager PCM600≤ 2.14No fix yet
Remediation & Mitigation
0/4
Do now
0/2
WORKAROUNDConfigure ABBPCMSchedulerService to run using the same Windows user account that operates PCM600 instead of SYSTEM privileges
HARDENINGGrant the configured PCM600 user account the 'Log on as a service' Windows privilege
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HARDENINGRestrict PCM600 user group membership to only those who require direct access to the tool
Long-term hardening
0/1
HARDENINGOnly enable 'Always trust IED security certificates' in PCM600 if communication occurs in a secure, isolated network segment
View full CISA ICS-CERT advisory
API: /api/v1/advisories/2c17307e-4b80-4903-a95c-b65be9024f51

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

ABB Protection and Control IED Manager PCM600 | CVSS 6.4 - OTPulse