Skip to content
OpenAdvisories
Medium 2NGA003179 1 CVE

ABB Protection and Control IED Manager (PCM600) - PCM600 Project Import Path Traversal

Published Sep 28, 2026 · Updated Sep 28, 2026

Vendor: ABB Product: Protection and control IED manager (PCM600)

Summary

ABB is aware of a privately reported vulnerability affecting the PCM600 project import functionality. An update is available that resolves this vulnerability in the affected product versions.

A specially crafted PCM600 project archive may exploit insufficient validation of archive entry paths during project import. Successful exploitation could allow an attacker to create or overwrite files outside the intended extraction directory using the permissions of the importing user.

Vulnerabilities 1

  • Medium 5.0
    CVE-2026-15953

    Path Traversal During Project Archive Import

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Protection and control IED manager (PCM600). This issue affects Protection and control IED manager (PCM600): through 2.14.

    ABB Protection and control IED manager (PCM600) ICS / OT

Revision history

  1. #1

    Initial version.

References

  • ABB CYBERSECURITY ADVISORY - PDF Version
    https://search.abb.com/library/Download.aspx?DocumentID=2NGA003179&LanguageCode=en&DocumentPartId=pdf&Action=Launch
  • PCM600 | ABB
    https://www.abb.com/global/en/areas/electrification/medium-voltage/grid-components/primary-protection-relays/pcm600