{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Abhinav Agarwal"
        ],
        "summary": "identifying this vulnerability and reporting it in a professional manner"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "\u00a9 Copyright 2026 ABB. All rights reserved.",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "ABB is aware of a privately reported vulnerability affecting the PCM600 project import functionality. An update is available that resolves this vulnerability in the affected product versions.\n\nA specially crafted PCM600 project archive may exploit insufficient validation of archive entry paths during project import. Successful exploitation could allow an attacker to create or overwrite files outside the intended extraction directory using the permissions of the importing user.\n\n",
        "title": "Summary"
      },
      {
        "category": "other",
        "text": "For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:\n\n- Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).\n- Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.\n- Never connect programming software or computers containing programing software to any net-work other than the network for the devices that it is intended for.\n- Scan all data imported into your environment before use to detect potential malware infections.\n- Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.\n- Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.\n- When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.\n",
        "title": "General security recommendations"
      },
      {
        "category": "other",
        "text": "For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.\n\nInformation about ABB\u2019s cyber security program and capabilities can be found at www.abb.com/cybersecurity.",
        "title": "Support"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.\n\nABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.\n\nThis document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.\n\nAll rights to registrations and trademarks reside with their respective owners.\n",
        "title": "Notice"
      },
      {
        "category": "faq",
        "text": "What causes the vulnerability?\n- The vulnerability is caused by insufficient validation of archive entry paths during extraction of imported PCM600 project archives. A specially crafted archive may exploit path traversal sequences to write files outside the intended extraction directory.\n\nWhat might an attacker use the vulnerability to do?\n- An attacker could create or overwrite files outside the intended extraction directory using the permissions of the user who performs the import operation.\n\nHow could an attacker exploit the vulnerability?\n- An attacker could create a specially crafted PCM600 project archive and persuade a user to import it into PCM600. During archive extraction, traversal paths contained within the archive could result in files being written outside the intended extraction directory.\n\nCould the vulnerability be exploited remotely? \n- No, the vulnerability requires user interaction. An attacker must first deliver a specially crafted project archive and convince a user to import it into PCM600.\n\nCan functional safety be affected by an exploit of this vulnerability?\n- The reported vulnerability affects the project archive import process on the engineering workstation. But the configuration and IED functionality will remain unaffected, even if the project backup files contains extra content that is not part of the PCM600-defined template format. However, unauthorized modification of files on an engineering workstation could potentially be leveraged for additional malicious activities depending on the deployment environment.\n\nWhat does the update do?\n- The update removes the vulnerability by strengthening validation of archive entry paths during project import operations and preventing project archive contents from being extracted outside the intended destination directory.\n\nWhen this security advisory was issued, had this vulnerability been publicly disclosed?\n- No, ABB received information about this vulnerability through responsible disclosure.\n\nWhen this security advisory was issued, had ABB received any reports that this vulnerability was being exploited?\n- No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.\n",
        "title": "Frequently asked questions"
      },
      {
        "category": "other",
        "text": "ABB has a rigorous internal cyber security continuous improvement process which involves regular testing with industry leading tools and periodic assessments to identify potential product issues. Occasionally an issue is determined to be a design or coding flaw with implications that may impact product cyber security.\n\nWhen a potential product vulnerability is identified or reported, ABB immediately initiates our vulnerability handling process. This entails validating if the issue is in fact a product issue, identifying root causes, determining what related products may be impacted, developing a remediation, and notifying end users and governmental organizations.\n\nThe resulting Cyber Security Advisory intends to notify customers of the vulnerability and provide details on which products are impacted, how to mitigate the vulnerability or explain workarounds that minimize the potential risk as much as possible. The release of a Cyber Security Advisory should not be misconstrued as an affirmation or indication of an active threat or ongoing campaign targeting the products mentioned here. If ABB is aware of any specific threats, it will be clearly mentioned in the communication.\n\nThe publication of this Cyber Security Advisory is an example of ABB\u2019s commitment to the user community in support of this critical topic. Responsible disclosure is an important element in the chain of trust we work to maintain with our many customers. The release of an Advisory provides timely information which is essential to help ensure our customers are fully informed.",
        "title": "Purpose"
      }
    ],
    "publisher": {
      "category": "vendor",
      "name": "ABB PSIRT",
      "namespace": "https://www.abb.com/global/en/company/about/cybersecurity/alerts-and-notifications"
    },
    "references": [
      {
        "category": "self",
        "summary": "ABB CYBERSECURITY ADVISORY - PDF Version ",
        "url": "https://search.abb.com/library/Download.aspx?DocumentID=2NGA003179\u0026LanguageCode=en\u0026DocumentPartId=pdf\u0026Action=Launch"
      },
      {
        "category": "self",
        "summary": "ABB CYBERSECURITY ADVISORY - CSAF Version ",
        "url": "https://psirt.abb.com/csaf/2026/2nga003179.json"
      },
      {
        "summary": "PCM600 | ABB ",
        "url": "https://www.abb.com/global/en/areas/electrification/medium-voltage/grid-components/primary-protection-relays/pcm600"
      }
    ],
    "title": "ABB Protection and Control IED Manager (PCM600) - PCM600 Project Import Path Traversal",
    "tracking": {
      "current_release_date": "2026-09-28T00:30:00.000Z",
      "generator": {
        "date": "2026-09-28T12:10:30.005Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.6.13"
        }
      },
      "id": "2NGA003179",
      "initial_release_date": "2026-09-28T00:30:00.000Z",
      "revision_history": [
        {
          "date": "2026-09-28T00:30:00.000Z",
          "number": "1",
          "summary": "Initial version. "
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=2.14",
                "product": {
                  "name": "ABB Protection and control IED manager PCM600 \u003c=2.14",
                  "product_id": "AV1"
                }
              },
              {
                "category": "product_version",
                "name": "2.14 Hotfix 20260923",
                "product": {
                  "name": "ABB Protection and control IED manager PCM600 2.14 Hotfix 20260923",
                  "product_id": "FX1"
                }
              }
            ],
            "category": "product_name",
            "name": "Protection and control IED manager PCM600"
          }
        ],
        "category": "vendor",
        "name": "ABB"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-15953",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability exists in the processing of PCM600 project archives files. Insufficient validation of archive entry paths may permit path traversal during extraction, potentially allowing files to be written to locations outside the intended extraction directory.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "NVD - CVE-2026-15953",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15953"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the following product version:\n\n- ABB Protection and Control IED Manager (PCM600) version 2.14 Hotfix 20260923.\n\nThis fixed version is available through the ABB Update Manager and ABB website: PCM600 | ABB\n\nABB recommends that customers upgrade to the available hotfix at the earliest opportunity. Until the update can be applied, customers should follow the mitigation measures described in this advisory.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "mitigation",
          "details": "The risk is significantly reduced when PCM600 is configured with High Security Level, as unsigned project files cannot be imported. As a result, attackers cannot rely on users importing manipulated unsigned archives.\n\nOrganizations that restrict project imports to trusted sources and enforce High Security Level settings substantially reduce exposure to this vulnerability. \n\nRefer to section \u201cGeneral security recommendations\u201d for further advise on how to keep your system secure.\n",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "availabilityRequirement": "LOW",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "confidentialityRequirement": "LOW",
            "environmentalScore": 2.9,
            "environmentalSeverity": "LOW",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "integrityRequirement": "LOW",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 4.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C/CR:L/IR:L/AR:L",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2026-15953"
    }
  ]
}