This vulnerability arises from an incorrect permission assignment in the Scheduler Service of ABB Protection and Control IED Manager. The improper assignment allows a user or process to modify or delete scheduled tasks that control critical industrial processes, potentially leading to unauthorized changes in process logic or system behavior. With such control, an attacker could alter configuration or trigger disruptive actions, compromising the integrity and availability of the system.

Systems affected are ABB Protection and Control IED Manager (PCM600) versions up to and including 2.14. The specific product is the PCM600 device that manages industrial protected current devices.

The CVSS base score of 7.1 indicates a medium-to-high severity risk. EPSS is not available, and the vulnerability is currently not listed in the CISA KEV catalog, suggesting limited known exploitation. The likely attack vector is a local or remote user with sufficient rights to interact with the Scheduler Service, who could then abuse the elevated permissions. Until an official patch is released, administrators should treat this as a moderate‑to‑high risk and take the recommended mitigations.