CyberzSOC

Publication detail
← Back to advisories & guidance

ICSA-26-120-02: ABB PCM600 ↗ source

April 30, 2026 CISA ICS Advisory
Source: https://www.cisa.gov/news-events/ics-advisories/icsa-26-120-02

Summary

An update is available that resolves vulnerability in the product versions listed as affected in this advisory. An attacker who successfully exploited this vulnerability could insert and run arbitrary code in the system. CVE-2018-1002208: A vulnerability exists in the SharpZip.dll included in the product versions listed above. An attacker could exploit vulnerability by providing a specially crafted message to the system node, causing insertion, and running of arbitrary code.

Advisory Details CISA ICS CSAF feed

Advisory ID
ICSA-26-120-02
Status
Final · version 3
Initial release
2025-11-03
Last revised
2026-05-13 (3 revisions)
Vendor
ABB
Critical infrastructure sectors
Critical Manufacturing
Deployed
Worldwide
Vendor headquarters
Switzerland

Republished vendor advisory. This ICSA is a verbatim republication of ABB PSIRT 2NGA002813 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not…

Mitigating factors: Mitigating factors describe conditions and circumstances that make an attack that exploits vulnerability difficult or less likely to succeed. Refer to section “General security recommendations” for further advise on how to keep your system secure.

Credit: ABB PSIRT

Affected products (1)
  • PCM600 — >=1.5|<=2.13, 2.14
Revision history (3)
  • 2026-05-13 — v3: Removed typo in document.title
  • 2026-04-30 — v2: Initial CISA Republication of ABB PSIRT 2NGA002813 advisory
  • 2025-11-03 — v1: Initial version.

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVEWeaknessCVSS v3Details
CVE-2018-1002208 CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 4.4 Medium CVE-2018-1002208
A vulnerability exists in the SharpZip.dll included in the product versions listed above. An attacker could exploit vulnerability by providing a specially crafted message to the system node, causing insertion, and running of arbitrary code.

Vendor fix: The problem is corrected in the following product version: ABB Protection and control IED manager PCM600 version 2.14. ABB recommends that customers apply the update at earliest convenience. Note: RE_630 protection relays are not compatible with PCM600 versio…

Affected, fixed & timeline

Affected:

  • PCM600 >=1.5|<=2.13

Fixed in:

  • PCM600 2.14

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVECVSSAffected
CVE-2018-1002208 — SharpZipLib SharpZipLib SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip ar…

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

No KEV-catalogued vendors are named in this publication.