My Control System 26.5 – Disk space exhaustion due to incorrect temporary file cleanup after XML conversion

The problem is corrected in the following product versions: - My Control System 26.6 (all deployment types) ABB recommends that customers apply the update at earliest convenience. NOTE - Installations of MCS on Edgenius with version 26.5 or earlier are not eligible for an update to MCS 26.6, as this requires an OS upgrade to EdgeniusOS 3.3.0 or later. Support for the required OS upgrade is expected with the upcoming EdgeniusOS 4.0.0 and the corresponding MCS package. Until an upgrade path is available, please follow the workaround in this document. A follow up communication will be provided once the OS upgrade path is available. More information can be found in Product Update with document ID: 2PAA121211 listed in the reference section. In addition to performing an update on eligible systems, it is recommended to manually delete the contents of the following system folder one time after the installation of My Control System 26.6 has been completed. This applies to Windows-based installations only. Windows temp directory: C:\Users\<system service account>\AppData\Local\Temp For Edgenius installations, please follow instructions provided below to clean up temporary files used by the MCS containers.

Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. Refer to section General security recommendations for further advice on how to keep your system secure. For the reported issue there are no known mitigating factors.

Workarounds are specific measures that a user can take to help block an attack, for example, temporarily disabling the vulnerable feature may remove the exposure with well-known impact on functionality. ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is identified below as “Impact of workaround”. As a workaround for the reported issue the temporary files could be deleted manually: - Windows environments For Windows environments, manually delete the contents of the directory below: C:\Users\<system service account>\AppData\Local\Temp - Edgenius environments NOTE - The procedure described below is a recovery measure only and does not prevent the issue itself. A permanent fix is available in My Control System version 26.6, but it is currently not possible to update existing installations of My Control System 26.5 due to limitations with Edgenius OS upgrades. These procedures are for temporary use only. A permanent solution and upgrade instructions will be provided once an Edgenius OS upgrade path is available. For Edgenius installations, manually run the following command within the host environment. kubectl delete pod -l app.kubernetes.io/component=mcs-masterkpi -n my-control-system This restarts the container that can build up temporary files over time and ensures these files are cleaned up. The workaround should only be performed while there is no analysis in progress.