Which versions of Panduit IntraVUE are affected by CVE-2026-40430?

Pronetiqs IntraVUE (versions 3.2.1a14 and prior) exposes all stored credentials in plaintext via an unauthenticated network API.

How to fix or mitigate CVE-2026-40430?

Within 24 hours: Identify all IntraVUE deployments running version 3.2.1a14 or earlier and implement firewall rules to restrict external network access to the API endpoint; contact Pronetiqs technical support for emergency mitigation options. Within 7 days: Rotate all credentials stored within IntraVUE, prioritizing those with access to critical systems and industrial control networks; implement network segmentation to isolate IntraVUE instances from critical infrastructure. Within 30 days: Monitor ICSA-26-204-04 for vendor patch availability; if no patch is released, evaluate architectural changes such as air-gapping or replacing the tool with alternatives that encrypt credential storage.

Panduit IntraVUE CVE-2026-40430

Q: What is the CVSS score of CVE-2026-40430?

CVE-2026-40430 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-48445 HIGH

Plaintext Storage of a Password (CWE-256)

2026-07-23 icscert

GHSA-83v4-8c4r-j7c4

Information Disclosure Panduit Intravue Pronetiqs

8.7

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable API disclosure with low complexity and no interaction; PR:N follows the assigned vector though API auth is unconfirmed; confidentiality-only, so I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 23, 2026 - 23:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 23:22 vuln.today

cvss_changed

CVSS changed

Jul 23, 2026 - 23:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

Jul 23, 2026 - 22:47 vuln.today

CVE Published

Jul 23, 2026 - 21:58 cve.org

HIGH 7.5

DescriptionCVE.org

Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API.

AnalysisAI

Cleartext credential exposure in Pronetiqs IntraVUE (Panduit IntraVUE) versions 3.2.1a14 and prior allows an attacker to retrieve stored passwords in plaintext via the product's API, because credentials are never hashed or encrypted at rest. This industrial-network visualization tool is affected across all builds up to and including 3.2.1a14, and per the CVSS 4.0 vector the disclosure is reachable over the network without authentication (VC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the ICS-CERT advisory (ICSA-26-204-04) confirms the flaw.

Technical ContextAI

IntraVUE is a network mapping and diagnostic platform used to visualize and monitor industrial/OT Ethernet infrastructure, exposing a management API for automation and integration. The root cause is CWE-256 (Plaintext Storage of a Password): the application persists account credentials without hashing or encryption, so any code path that reads that store - here, an API endpoint - returns usable cleartext secrets. The CPE cpe:2.3:a:pronetiqs:panduit_intravue identifies the affected software; the vulnerability is in how the application handles credential storage rather than in any transport-layer or protocol weakness.

RemediationAI

No specific fixed version was provided in the input data, so no vendor-released patch version can be cited here - consult the CISA ICS advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-04 for the vendor's remediated build and upgrade guidance, and upgrade beyond 3.2.1a14 once the fixed release is identified. As compensating controls until patched: restrict network access to the IntraVUE API so only trusted management hosts can reach it (via host firewall or network ACLs), which prevents remote credential retrieval but may break legitimate integrations that call the API; place the IntraVUE server on an isolated OT management VLAN behind segmentation, at the cost of added routing/administration overhead; and, because credentials are stored in cleartext, rotate any passwords held in IntraVUE and avoid reusing them elsewhere so that a disclosure does not compromise other systems.