ABB is aware of a reported vulnerability in ABB Protection and Control IED Manager (PCM600).

A local authenticated user belonging to the PCM600 user group may be able to modify the configuration of a Windows service running with SYSTEM privileges. Successful exploitation could allow an attacker to execute arbitrary commands with elevated privileges on the affected workstation.

Note: This document references the ABBPCMSchedulerService_v214 component as implemented in PCM600 version 2.14. However, the described issue is not version-specific and applies equally to the corresponding component in other supported versions of PCM600.

Incorrect Permission Assignment for Critical Resource vulnerability in ABB Protection and control IED manager (PCM600).

This issue affects Protection and control IED manager (PCM600): through 2.14.

Incorrect Permission Assignment for Critical Resource vulnerability in ABB Protection and control IED manager (PCM600).

This issue affects Protection and control IED manager (PCM600): through 2.14.

A vulnerability exists in the Scheduler Service installed with PCM600. The service executes under the LocalSystem account while permissions are granted to standard PCM600 users through membership in the local users group. An attacker with local access and valid user credentials may exploit this vulnerability to elevate privileges and obtain control of the affected host. A vulnerability exists in the processing of PCM600 project archives files. Insufficient validation of archive entry paths may permit path traversal during extraction, potentially allowing files to be written to loca tions outside the intended extraction directory.