CVE-2026-15953

ABB Protection and Control IED Manager PCM600, through version 2.14, has a path traversal flaw (CWE-22) that fails to keep a pathname inside a restricted directory. A local attacker who already has low privileges can trigger it only with user interaction and an additional attack precondition (CVSS 4.0 5.6: AV:L/AC:L/AT:P/PR:L/UI:A). The scored impact is high integrity on the vulnerable system and on subsequent systems, with no confidentiality or availability impact. Affected users are organizations that run this engineering tool to manage ABB protection and control IEDs, typically electric utilities and industrial operators. It is not in CISA KEV, and no public proof-of-concept is known.

What to do: Treat every PCM600 build through 2.14 as affected and move to the ABB-fixed release as soon as the vendor publishes it; the advisory does not name a patched version. Until then, limit PCM600 to trusted engineering accounts, do not process untrusted input in the tool, and follow ABB's advisory from cybersecurity@ch.abb.com. If untrusted input was recently used, review those workstations for unexpected file changes.