Successful exploitation of these vulnerabilities, discovered by researcher Abhinav Agarwal, could allow an attacker to escalate privileges or overwrite files.
ABB Protection and Control IED Manager PCM600 is a software engineering tool used to configure, commission, maintain, and manage ABB’s Relion family of protection and control intelligent electronic devices (IEDs) across power transmission and distribution networks.
Protection and Control IED Manager PCM600 up to and including versions 2.14 suffer from the vulnerabilities.
In one issue, a vulnerability exists in the Scheduler Service installed with PCM600. The service executes under the LocalSystem account while permissions end up granted to standard PCM600 users through membership in the local users group. An attacker with local access and valid user credentials may exploit this vulnerability to elevate privileges and obtain control of the affected host.
CVE-2026-15952 is the case number for the vulnerability, which has a CVSS V3 base score of 6.4. There is also a V4 base score of 7.1.
Another Vulnerability
Additionally, a vulnerability exists in the processing of PCM600 project archives files. Insufficient validation of archive entry paths may permit path traversal during extraction, potentially allowing files to be written to locations outside the intended extraction directory.
CVE-2026-15953 is the case number for the vulnerability, which has a CVSS V3 base score of 5. There is also a V4 base score of 5.6.
The product sees use mainly in the energy sector, and on a global basis.
No exploit currently targets these vulnerabilities.
In terms of mitigations, configure the appropriate ABBPCMSchedulerService instance to run using the same Windows account used to operate PCM600:
- Open Services.msc
- Locate the ABBPCMSchedulerService corresponding to the installed PCM600 version
- Open Properties and select the Log On tab
- The service should end up configured to log on with the same Windows user account used for the PCM600 application
- Ensure this account has the required “Log on as a service” privilege
When authentication ends up enabled for the IED, you can use the Scheduler tool with the same Windows account configured as the Scheduler Service logon account.
For installations using IED security certificates, the PCM600 setting Always trust IED security certifcates must end up enabled only when PCM600-to-IED communication takes place in a secure and trusted environment.
For more information, see ABB security advisory 2NGA003170 and 2NGA003179.