Most recent entries from all

2NGA003170 — ABB Protection and Control IED Manager PCM600 Scheduler Service Privilege Escalation Vulnerability

ABB is aware of a reported vulnerability in ABB Protection and Control IED Manager (PCM600).

A local authenticated user belonging to the PCM600 user group may be able to modify the configuration of a Windows service running with SYSTEM privileges. Successful exploitation could allow an attacker to execute arbitrary commands with elevated privileges on the affected workstation.

Note: This document references the ABBPCMSchedulerService_v214 component as implemented in PCM600 version 2.14. However, the described issue is not version-specific and applies equally to the corresponding component in other supported versions of PCM600.

EUVD-2026-377782

fkie_cve-2026-15952

Incorrect Permission Assignment for Critical Resource vulnerability in ABB Protection and control IED manager (PCM600).

This issue affects Protection and control IED manager (PCM600): through 2.14.

GHSA-xfjh-6447-rv2j

Incorrect Permission Assignment for Critical Resource vulnerability in ABB Protection and control IED manager (PCM600).

This issue affects Protection and control IED manager (PCM600): through 2.14.

ICSA-26-274-03 — ABB Protection and Control IED Manager PCM600

A vulnerability exists in the Scheduler Service installed with PCM600. The service executes under the LocalSystem account while permissions are granted to standard PCM600 users through membership in the local users group. An attacker with local access and valid user credentials may exploit this vulnerability to elevate privileges and obtain control of the affected host. A vulnerability exists in the processing of PCM600 project archives files. Insufficient validation of archive entry paths may permit path traversal during extraction, potentially allowing files to be written to loca tions outside the intended extraction directory.