EUVD-2026-48449
GHSA-f6pj-m25g-9pq4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach IntraVUE web interface over network
-
DeliverySend crafted request to disclosure endpoint
-
ExploitApplication reads host/share filesystem
-
ExecutionRetrieve sensitive files and credentials
-
ImpactLeverage data for OT reconnaissance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection System info exposure prevention
|
| Exploitation Conditions | Exploitation requires network reachability to the IntraVUE application's exposed interface on a host running version 3.2.1a14 or earlier - per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) no authentication, no user interaction, and no special attack requirement is needed against a default deployment. The concrete limiting factor is network exposure: IntraVUE servers segmented off the routable/corporate network or firewalled to trusted management stations only are not remotely reachable, which materially reduces real-world exploitability. The impact is confined to information disclosure of the host/share filesystem (VC:H/SC:H, VI:N/VA:N) - there is no code execution or data modification, so the condition for meaningful harm is that sensitive data (credentials, configs, OT intelligence) resides on the accessible filesystem or shares. |
| Impact | The CVSS 4.0 base score of 9.2 (Critical) reflects a fully remote, low-complexity, unauthenticated vector (AV:N/AC:L/AT:N/PR:N/UI:N) with high confidentiality impact on both the vulnerable and a subsequent system (VC:H, SC:H) and no integrity or availability impact (VI:N/VA:N). No EPSS score was provided in the input, and the CVE is not in CISA KEV, so there is no evidence of active exploitation; no POC was referenced either, meaning the near-worst-case CVSS is driven by exploitability characteristics rather than observed attacks. The signals are internally consistent - the description ('expose the underlying host/share filesystem') aligns with the CWE-497 information-disclosure classification and the confidentiality-only impact vector. The realistic priority is elevated because IntraVUE runs in OT/ICS environments where filesystem exposure can leak credentials, configuration, and topology intelligence, but the absence of EPSS/KEV/POC data suggests this is currently a proactive-patch situation rather than a confirmed in-the-wild threat. |
| Exploit ScenarioDerived | An attacker with network reachability to the IntraVUE server sends crafted requests to the exposed web interface and retrieves files from the underlying host or mounted network shares without needing any credentials. Given AV:N/AC:L/PR:N/UI:N, this requires only connectivity and no user interaction; the attacker could harvest configuration files, stored credentials, or OT topology data. No public POC was referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 23, 2026
Sensitive information disclosure in Pronetiqs IntraVUE (marketed as Panduit IntraVUE) versions 3.2.1a14 and prior allows remote unauthenticated attackers to read the underlying host and network share filesystem through the industrial-network visualization application. Rated CVSS 4.0 9.2 (Critical) by ICS-CERT, the flaw exposes files outside the application's intended access boundary. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-facing, no-authentication profile makes it a high-priority patch for OT environments.
Earlier versions of this analysis (1)
Sensitive information disclosure in Pronetiqs IntraVUE (also branded Panduit IntraVUE) versions 3.2.1a14 and prior allows a remote, unauthenticated attacker to reach the underlying host or network share filesystem, exposing files outside the application's intended control sphere. The CVSS 3.1 base score is 8.6 (High) with a scope change, reflecting that the leak crosses from the application into the host system. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue was reported through CISA ICS-CERT (advisory ICSA-26-204-04).
RemediationAI
Consult the CISA ICS advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-04 and upgrade to the vendor's fixed release above 3.2.1a14; an exact patched version number is not present in the provided input, so treat 'apply the vendor-supplied update referenced in ICSA-26-204-04' as the primary action rather than an invented version. Because the exposure is reachable over the network without authentication, if a patch cannot be applied immediately, restrict network access to the IntraVUE web/management interface using firewall rules or an OT segmentation/DMZ so only trusted management hosts can reach it, and place the server behind a VPN - the trade-off is that legitimate remote operators lose direct access and must connect through the controlled path. Additionally, run the IntraVUE service under a least-privilege account with minimal filesystem and share permissions to reduce what an attacker can read, accepting that overly tight permissions may break IntraVUE's own discovery features and require testing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IntraVUE is a web-based network topology discovery and monitoring product used on industrial/OT networks to map and visualize connected devices. The root cause is classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), meaning the application serves or reveals host- and share-level filesystem data to a sphere (the network-facing web interface) that should not have that access. The affected component is identified by CPE cpe:2.3:a:pronetiqs:panduit_intravue, confirming this is the Pronetiqs-developed application distributed under the Panduit brand. The CVSS 4.0 vector's subsequent-system confidentiality impact (SC:H) indicates the disclosure reaches beyond the application itself into the underlying host/shared filesystem.
Know when Panduit Intravue gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Remote, unauthenticated, low-complexity filesystem disclosure crossing into the host/share (scope change S:C) with confidentiality-only impact, hence C:H and I/A:N.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
4DescriptionCVE.org
Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could expose the underlying host/share filesystem.
Executive ViewAI
Panduit IntraVUE versions 3.2.1a14 and earlier contain a critical remote information disclosure vulnerability (CVE-2026-28698, CVSS 9.2) that allows unauthenticated attackers to read arbitrary files on the hosting system. This flaw directly exposes sensitive operational and network data in industrial environments without requiring any credentials, creating immediate risk to OT asset visibility, configuration integrity, and compliance posture.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to IntraVUE instances via firewall rules and network segmentation to trusted administrative subnets only; implement jump-host/bastion authentication for all administrative access; enable comprehensive application and OS-level logging to detect unauthorized file read attempts; monitor for anomalous data exfiltration patterns; consider operational continuity by deploying alternative visualization solutions in parallel.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Panduit Intravue
View allNetwork-segmentation bypass in Pronetiqs (Panduit) IntraVUE 3.2.1a14 and earlier lets a remote, unauthenticated attacker
Cleartext credential exposure in Pronetiqs IntraVUE (Panduit IntraVUE) versions 3.2.1a14 and prior allows an attacker to
Credential theft in Pronetiqs/Panduit IntraVUE (versions 3.2.1a14 and prior) stems from the use of a cryptographically w
Unauthenticated network asset discovery exposure in Pronetiqs IntraVUE (formerly Panduit IntraVUE) versions 3.2.1a14 and
Exploit-DB