ABB PCM600 CVE-2026-15953

Requires local access to a host running ABB PCM600 (through version 2.14) with at least low-privilege authenticated access, plus user interaction: a legitimate operator must open or import an attacker-supplied malicious project/configuration/import file containing crafted traversal pathnames. Limiting factors per the CVSS vector are significant - AV:L rules out remote network exploitation, PR:L requires prior local foothold, and UI:R requires tricking an engineer into processing the malicious file; impact is confined to integrity (file overwrite/corruption) with no confidentiality or availability effect. This is engineering-workstation software used in electrical substation/utility environments, further limiting exposure to a small operator population.

This is a moderate, contained risk rather than a critical priority. The vendor-assigned CVSS 3.1 vector (5.0) is decisive: AV:L means the attacker must have local access to the machine running PCM600, AC:L/PR:L means low-privilege authenticated local access, and UI:R means a legitimate user must be tricked into an action (e.g., opening or importing a malicious file/project). Impact is narrow - C:N/I:H/A:N - so this is a write/overwrite-style path traversal affecting integrity only, with no data disclosure or denial of service. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation is currently theoretical: no public exploit identified at time of analysis. SSVC-style reasoning: exploitation status = none observed, automatable = no (requires local access plus user interaction), technical impact = partial (integrity-only). The main tension is that a local + user-interaction + low-privilege vector is inherently hard to exploit at scale, which is consistent with the modest 5.0 score; there is no conflict between signals here. Bottom line: real but low-urgency - patch on normal maintenance cadence, not an emergency.

An attacker crafts a malicious PCM600 project file, configuration package, or import artifact containing traversal sequences in an embedded pathname, then delivers it to a substation engineer. When the engineer opens or imports the file in PCM600 (through 2.14), the traversal writes attacker-controlled content to files outside the intended directory, corrupting or overwriting integrity-sensitive engineering data on the local host. No public exploit code is identified at time of analysis, and the attack requires the victim's interaction on a system where the attacker already has low-privilege local access.