CVE-2026-15953
mediumPriorität · verfolgen · 0EPSS 0.001 · 1. PerzentilCHUSEPSS · bewertet 2026-10-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Protection and control IED manager (PCM600). This issue affects Protection and control IED manager (PCM600): through 2.14.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenProtection and Control IED Manager PCM600abb_psirt
The problem is corrected in the following product version: - ABB Protection and Control IED Manager (PCM600) version 2.14 Hotfix 20260923. This fixed version is available through the ABB Update Manager and ABB website: PCM600 | ABB ABB recommends that customers upgrade to the available hotfix at the earliest opportunity. Until the update can be applied, customers should follow the mitigation measures described in this advisory.
- MitigationProtection and Control IED Manager PCM600abb_psirt
The risk is significantly reduced when PCM600 is configured with High Security Level, as unsigned project files cannot be imported. As a result, attackers cannot rely on users importing manipulated unsigned archives. Organizations that restrict project imports to trusted sources and enforce High Security Level settings substantially reduce exposure to this vulnerability. Refer to section “General security recommendations” for further advise on how to keep your system secure.
- MitigationProtection and Control IED Manager PCM600cisa_csaf_ot
ABB recommends the following workaround. Although this workaround does not correct the underlying vulnerability, it reduces the risk of privilege escalation.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 1.3–5.6
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (4)
Betroffene Produkte und Versionsbereiche.
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- 2NGA003179ABB Protection and Control IED Manager (PCM600) - PCM600 Project Import Path Traversal2026-09-28csaf · abb_psirtCH
ABB is aware of a privately reported vulnerability affecting the PCM600 project import functionality. An update is available that resolves this vulnerability in the affected product versions. A specially crafted PCM600 project archive may exploit insufficient validation of archive entry paths during project import. Successful exploitation could allow an attacker to create or overwrite files outside the intended extraction directory using the permissions of the importing user.
- ICSA-26-274-03ABB Protection and Control IED Manager PCM6002026-10-01icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges or overwrite files.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (1) nvd
Externe Belege — Patches, Meldungen, Analysen.
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan