EUVD-2026-88248
GHSA-xfjh-6447-rv2j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local access to PCM600 host
-
DeliveryIdentify critical resource with weak ACL
-
ExploitRead or modify protected resource
-
ExecutionCompromise IED manager integrity and data
-
ImpactImpact substation engineering workflow
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V13 - Configuration Permission assignment review
|
| Exploitation Conditions | Requires local access to the Windows host running ABB PCM600 (through 2.14); the flaw is an incorrect permission assignment (CWE-732) on a critical PCM600 resource, so exploitation depends on that resource being present and reachable on-host by the attacker. Limiting factors: the vendor vector specifies local attack vector (AV:L, no remote reachability), high privileges required (PR:H), and high attack complexity (AC:H), so realistic abuse presumes an attacker already operating on the engineering workstation with some privilege; no user interaction is needed (UI:N). Note the PR/AC choices may be conservative for a weak-ACL bug that could instead favor a lower-privileged local user. |
| Impact | This is a genuine but low-urgency issue. The CVSS 4.0 vector (AV:L/AC:H/PR:H/UI:N) describes a LOCAL vulnerability requiring high privileges and high attack complexity, yielding a 7.1 driven entirely by full vulnerable-system impact (VC:H/VI:H/VA:H) with no scope change. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so real-world exploitation pressure is minimal. The signals are internally consistent (self-reported by ABB, local vector, no remote reachability), meaning this is a high-CVSS-but-low-real-risk item rather than an active priority - it matters most in OT/ICS environments where an insider or an existing foothold on the engineering workstation is already assumed. One caveat: for a CWE-732 incorrect-permission-assignment flaw, the vendor's PR:H/AC:H may be conservative; weak ACLs on a critical resource typically benefit a LOWER-privileged local user (PR:L) via a straightforward path (AC:L), which would raise real severity - verify the exact permission target against ABB advisory 2NGA003170. |
| Exploit ScenarioDerived | An attacker with local access to a Windows engineering workstation running ABB PCM600 (through 2.14) leverages overly permissive filesystem/registry ACLs on a critical PCM600 resource to read, modify, or replace it, gaining full confidentiality, integrity, and availability impact over the IED-management application. No public exploit code exists; exploitation requires prior local access and, per the vendor vector, elevated privileges and non-trivial conditions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 28, 2026
Incorrect permission assignment in ABB Protection and Control IED Manager (PCM600) through version 2.14 leaves a critical application resource on the Windows engineering workstation protected by weak access controls, letting a local user read and alter protected PCM600 data with high impact to confidentiality, integrity, and availability. Exploitation requires the attacker to already have local access to the host running PCM600 - the vendor vector describes a local attack (AV:L) with high privileges required (PR:H) and high attack complexity (AC:H), while our independent assessment scores it as a low-complexity local issue requiring only low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so a lower-privileged local account may be sufficient in practice. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation; ABB published the vendor advisory (document 2NGA003170), and this is a genuine but low-urgency issue.
Earlier versions of this analysis (1)
Incorrect permission assignment on a critical resource used by ABB PCM600 (Protection and Control IED Manager) versions 2.14 and earlier lets a local user on the engineering workstation read, alter, or disrupt data that should be protected, producing high impact across confidentiality, integrity, and availability. Exploitation requires local access to a host running PCM600 - the vendor vector rates it as high privilege (PR:H) with high attack complexity (AC:H), while our independent assessment rates it as low privilege (PR:L) with low complexity (AC:L); either way the flaw sits at a local privilege boundary rather than being reachable over the network. There is no public exploit code and no confirmed active exploitation (no CISA KEV listing), and no EPSS score was supplied, so this is a moderate, defense-in-depth-class hardening issue for OT/ICS engineering hosts rather than an urgent remote threat.
RemediationAI
Consult ABB's advisory (document 2NGA003170) and install the fixed PCM600 release as soon as ABB designates it; no exact patched version number is published in the available data, so the practical primary fix is to move off any build ≤ 2.14 to the newest vendor-supported release and apply ABB's guidance for hardening the installer and its data directories. Until then, apply compensating controls on each engineering workstation: correct the NTFS permissions on the PCM600 installation and data directories (for example under Program Files\ABB and the associated project/config/log paths) so that only the intended service account and administrators have write access, and remove inherited or overly broad entries such as Users or Everyone - the trade-off is that misapplied ACLs can break PCM600 operation or block legitimate engineers, so test before broad rollout. Restrict who can log on locally to the workstation (limit interactive and Remote Desktop access to named engineering accounts, disable shared or guest accounts), because exploitation depends on an attacker already operating on the host; this reduces the pool of users able to reach the misconfigured resource, at the cost of some operational convenience. Additional measures: run PCM600 under a least-privileged context rather than an administrative session, apply application allowlisting and endpoint monitoring for unexpected writes to PCM600 files or service reconfiguration (tampering may generate event-log and file-integrity signals), and segment engineering workstations from general IT networks so that a foothold elsewhere does not translate into a local PCM600 session. These are risk-reduction measures, not substitutes for the vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-732 (Incorrect Permission Assignment for Critical Resource): PCM600 installs a resource - such as an executable, service component, configuration store, log, or project data file - with filesystem or service permissions that are broader than necessary on the Windows host. PCM600 is ABB's IEC 61850-based engineering and management tool for protection and control IEDs in substation automation; because it touches device configuration and project databases, a weak ACL on any of those artifacts can expose sensitive engineering data, permit tampering with protection settings, or enable local privilege escalation/persistence on the engineering workstation. The CPE cpe:2.3:a:abb:protection_and_control_ied_manager_(pcm600) with no version constraint reflects that all builds through 2.14 are in scope, consistent with EUVD's affected range of PCM600 0 ≤ 2.14. There is no network vector here: the flaw is only meaningful to a principal that already has code execution or an interactive session on the same host, which is why the vendor vector is AV:L with PR:H/AC:H while our assessment favors the weaker-access interpretation (PR:L/AC:L) typical of insecure-permissions bugs.
Know when Protection And Control Ied Manager Pcm600 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weak permissions on a critical resource typically let a lower-privileged local user gain full control directly, so PR:L and AC:L; local-only vector with full C/I/A impact.
Primary rating from Vendor (ABB).
CVSS VectorVendor: ABB
Lifecycle Timeline
3DescriptionCVE.org
Incorrect Permission Assignment for Critical Resource vulnerability in ABB Protection and control IED manager (PCM600).
This issue affects Protection and control IED manager (PCM600): through 2.14.
Executive ViewAI
ABB PCM600, the engineering workstation application used to configure protection and control IEDs, is affected through version 2.14 by a high-severity access control flaw (CVE-2026-15952) for which ABB has not yet released a fixed version. An attacker who already holds a local account on a PCM600 workstation could read or alter protected application data, potentially corrupting the engineering configuration that operations and protection teams rely on, though no public exploit was identified at time of analysis and exploitation is not confirmed. Leadership should treat this as an unpatched, localized risk concentrated in the OT engineering workstation population rather than an immediate enterprise-wide exposure.
No vendor-released patch identified at time of analysis: restrict interactive local logon to authorized engineering staff, remove unnecessary local accounts and privileged group memberships, apply least privilege and stricter ACLs to PCM600 application and data directories, enable host logging/EDR monitoring for unexpected file changes, and limit network reachability of PCM600 workstations; monitor ABB advisory 2NGA003170 for a fixed release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB