CVE-2018-1002208: Improper Limitation of a Pathname to a Restricted Directory in SharpZipLib

CVE-2018-1002208 · Severity: high · CVSS 3.1 · Published 2022-05-13

ABB PCM600 is a software tool used to configure and manage protection and control devices in power systems and manufacturing plants. A vulnerability in a third-party library used by this software could allow an attacker to execute unauthorized code on the system. This could lead to the modification of device configurations or disruption of industrial operations, though it requires a user to interact with a malicious file.

Technologies: SharpZipLib (NuGet). Vendors: Hitachi Energy, NuGet.

Quick answers

Is CVE-2018-1002208 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2018-1002208 being exploited in the wild.
How severe is CVE-2018-1002208?
High severity, with a CVSS score of 3.1, published 13 May 2022.
Which products and versions are affected?
Hitachi Energy PCM600 <=2.11; Hitachi Energy PCM600 Legacy <=2.11; SharpZipLib (NuGet) ECOSYSTEM:introduced=0,fixed=1.0.0-rc1.
Is there a fix for CVE-2018-1002208?
Yes. SharpZipLib (NuGet): upgrade to 1.0.0-rc1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-1002208 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2018-1002208?
Check whether you run Hitachi Energy PCM600, Hitachi Energy PCM600 Legacy or SharpZipLib (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • SharpZipLib (NuGet): upgrade to 1.0.0-rc1 or later
    dotnet add package SharpZipLib --version 1.0.0-rc1

Technical details

A path traversal vulnerability (CWE-22) exists in the SharpZip.dll library bundled with ABB PCM600 versions 1.5 through 2.13. The flaw allows an attacker to bypass directory restrictions when the software processes specially crafted archive files or messages. Successful exploitation requires a local attacker to convince a user to open a malicious file (User Interaction) and involves high attack complexity. If exploited, the attacker can achieve arbitrary code execution on the host system. ABB has released PCM600 version 2.14 to address this issue, though some legacy protection relays (RE_630) are incompatible with the fix and require system-level mitigations.

Affected products

  • ABB PCM600 1.5 to 2.13

Identifiers

  • CVE-2018-1002208
  • GHSA-cqj4-m2pc-v9m5

Timeline

  • 2026-04-30: advisory: Initial CISA advisory release
  • 2026-04-30: patched: PCM600 version 2.14 released to fix the issue

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.