CVE-2026-15953 in Protection and control IED manager
Summary
by MITRE • 09/28/2026
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Protection and control IED manager (PCM600).
This issue affects Protection and control IED manager (PCM600): through 2.14.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/28/2026
The identified vulnerability represents a classic path traversal flaw within the ABB PCM600 software, specifically affecting versions up to release 2.14. This security defect falls under the category of Improper Limitation of a Pathname to a Restricted Directory, commonly known as CWE-22 in the Common Weakness Enumeration taxonomy. The core technical issue stems from insufficient validation or sanitization of user-supplied input that is used to construct file system paths. When an application processes such input without properly restricting it to a designated safe directory, an attacker can manipulate the path string using standard directory traversal sequences, typically represented by dot-dot-slash characters (../). By injecting these sequences into specific fields within the PCM600 interface or configuration files, an adversary can break out of the intended sandboxed environment and access arbitrary locations on the underlying operating system's file hierarchy.
From a technical perspective, this vulnerability allows for unauthorized read operations against sensitive system files that are not meant to be accessible through the application's normal workflow. In industrial control environments, software like PCM600 often handles critical configuration data, device parameters, and potentially credential stores. If an attacker can traverse outside the restricted directory, they may gain access to plaintext passwords, private keys, or other confidential information stored in adjacent directories. Furthermore, depending on the specific implementation details of how the file is subsequently processed by the application, there could be a risk of write operations if the software allows overwriting files based on user input, which would elevate the threat from simple data exfiltration to potential remote code execution or configuration tampering. This aligns with ATT&CK technique T1083, File and Directory Discovery, as well as T1552, Unsecured Credentials, if sensitive authentication materials are exposed through this vector.
The operational impact of this vulnerability is significant due to the critical nature of protection and control devices in power systems. PCM600 serves as a central management tool for Intelligent Electronic Devices (IEDs), which are responsible for monitoring and controlling electrical grid components. A successful exploitation could lead to the compromise of configuration integrity, allowing an attacker to alter trip settings or relay parameters without detection. This undermines the reliability and safety of the power infrastructure. Additionally, the exposure of internal system files can provide attackers with valuable intelligence about the network architecture, installed software versions, and security configurations, facilitating further lateral movement within the industrial control system (ICS) environment. The lack of strict path validation means that even a single point of entry through any file upload or configuration import feature could be leveraged to achieve these adverse outcomes.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary solution is for ABB to release an updated version of PCM600 beyond 2.14 that implements robust input validation and canonicalization techniques. Developers should enforce strict allow-listing for file paths, ensuring that only predefined directories are accessible regardless of the input provided. Implementing chroot jails or containerized environments can also limit the blast radius if a traversal attempt occurs. For organizations currently running affected versions, it is crucial to restrict network access to PCM600 workstations to trusted administrative IPs and ensure that these systems do not have direct internet connectivity. Regular patch management programs are essential to address such vulnerabilities promptly as they become available from the vendor. Security teams should also monitor for unusual file system activity or unexpected changes in configuration files associated with IEDs, which could indicate an ongoing exploitation attempt of this path traversal weakness.