ABB PCM600 Hotfix Blocks Project-Import Path Traversal
Tech GuruQuick Answer
A crafted PCM600 project archive can write outside its extraction directory using the importing user's permissions. ABB fixes CVE-2026-15953 in PCM600 2.14 Hotfix 20260923. This is the project-import issue, not the separate Scheduler service privilege-escalation issue.
Confirm Scope And Apply The Supported Fix
What to do now: obtain the hotfix through ABB Update Manager or the official PCM600 download channel and validate it on a backed-up project. Until then, restrict imports to trusted sources and review ABB's High Security Level mitigation; do not import a suspect archive to see whether it is dangerous.
Last verified: October 2, 2026 UTC against ABB CSAF revision 1. No hotfix or project import was executed.
Scope And Authority
| Product scope | ABB Protection and Control IED Manager PCM600 version 2.14 and earlier |
|---|---|
| Advisory | 2NGA003179 |
| CVE | CVE-2026-15953 |
| Authoritative release date | 2026-09-28 00:30:00 UTC (ABB CSAF initial release); added to the ABB CSAF feed at 2026-09-28 12:05:00 UTC |
| Authority revision date | 2026-09-28 00:30:00.000 UTC |
| Affected versions | ABB PCM600 version 2.14 and earlier when a user imports a crafted project archive. |
| Fixed version | ABB PCM600 2.14 Hotfix 20260923 through ABB Update Manager or the ABB PCM600 download channel |
| CVSS base score | 5.0 (CVSS v3.1) |
| CVSS severity | Medium |
| Exploitation status | ABB reported no information indicating exploitation at initial advisory issue; that statement is limited to that time. |
What Changed
The fix validates archive entry paths so imported contents cannot escape the intended destination. ABB also identifies High Security Level as an interim mitigation because it prevents unsigned project imports. That reduces exposure but does not replace the hotfix or prove that every accepted file is trustworthy.
What To Validate Now
- Preserve the project. Record PCM600 version, installed connectivity components and project provenance; retain a recovery copy before updating.
- Apply the named hotfix. Use ABB Update Manager or the official download source. For an older release, verify the supported migration/compatibility path rather than assuming the 2.14 hotfix installs directly.
- Test authorized import. Import a known-good project in the approved test environment, confirm its content and required IED workflow, and review the intended signed/unsigned import policy.
- Close this CVE only. Keep hotfix identity and validation evidence. Check the Scheduler advisory separately; this import hotfix does not establish its remediation.
Operational Cautions
Project archives are a trust boundary even after patching. Keep source provenance and use a normal engineering account rather than elevated privileges merely to bypass an import failure. Stop and investigate unexpected file writes; a successful import is not proof that an unknown archive is benign.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
