EUVD-2026-48446
GHSA-jp3p-8p4m-hxwj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed IntraVUE instance
-
DeliveryCoerce IntraVUE into active proxy
-
ExploitRelay traffic across OT segmentation
-
ExecutionAccess isolated OT devices
-
ImpactRead or manipulate control traffic
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service Proxy/intermediary controls
|
| Exploitation Conditions | The exploit requires network reachability to an IntraVUE instance (version 3.2.1a14 or earlier) that is positioned with connectivity spanning the segmentation boundary the attacker wishes to cross - IntraVUE's normal deployment as a cross-segment network-discovery tool is itself the enabling condition. Per CVSS AV:N/AC:L/PR:N/UI:N, exploitation needs no authentication, no user interaction, and no non-default configuration. The practical limiting factor is exposure: the attacker must be able to reach IntraVUE's proxy-capable service, so deployments where IntraVUE is confined to an isolated management VLAN or fronted by strict firewall rules materially reduce reachability, and the impact is only meaningful where IntraVUE actually bridges an IT/OT or inter-zone boundary. |
| Impact | All available severity signals point the same direction: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields a maximal 10.0, indicating remote, low-complexity, unauthenticated exploitation with a scope change into adjacent (OT) systems. That scope change is the crux - the direct technical impact on IntraVUE matters less than the downstream OT assets it can expose. However, EPSS was not provided, the CVE is not in CISA KEV, and no POC/exploit reference is present, so the real-world exploitation likelihood cannot be quantified from the input and should not be assumed high despite the 10.0 base score. The CVSS asserts a fully network-reachable unauthenticated path; verify against your deployment, because IntraVUE is often management-plane software whose exposure depends on whether its interface/services are reachable from untrusted networks. Net: treat as a high-priority segmentation-integrity risk in OT environments, but recognize that the 10.0 reflects worst-case scope impact rather than confirmed active exploitation. |
| Exploit ScenarioDerived | An attacker who can reach an exposed IntraVUE instance from an IT-side or otherwise untrusted network sends requests that coerce IntraVUE into proxying traffic through to devices in a segmented OT zone. Using this relay, the attacker reaches PLCs, HMIs, or other assets that firewall/VLAN segmentation was intended to isolate, then reads or manipulates OT communications. No authentication or user interaction is required per the CVSS vector, and no public POC is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Network-segmentation bypass in Pronetiqs (Panduit) IntraVUE 3.2.1a14 and earlier lets a remote, unauthenticated attacker abuse the product as an active proxy/intermediary to relay traffic across otherwise-isolated OT boundaries. Because IntraVUE typically sits with visibility into both IT and industrial control network segments, this confused-deputy behavior effectively neutralizes the network zoning that protects OT assets. Rated CVSS 10.0 with a scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
No vendor-released patch version is identified in the available data; consult CISA advisory ICSA-26-204-04 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-04) for the vendor's fixed build and upgrade guidance, and apply the vendor-remediated release as the primary fix once confirmed. In the interim, apply compensating controls consistent with ICS best practice: restrict network access to IntraVUE hosts and services so they are reachable only from a dedicated management segment or jump host (trade-off: legitimate operators must connect via that path), place IntraVUE behind an ICS-aware firewall and explicitly deny it from relaying traffic between IT and OT zones rather than relying on its own segmentation posture, and disable or block any inbound proxy/relay-capable interface that is not operationally required. Enforce that remote access to the OT environment uses hardened VPN and monitor IntraVUE for anomalous cross-segment connections. These controls reduce reachability but may complicate legitimate cross-segment discovery, which is IntraVUE's core function, so validate monitoring coverage after locking it down.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IntraVUE is an industrial network device-discovery and topology-visualization platform used to map and monitor Ethernet/OT networks, which requires it to be reachable across multiple network segments. The flaw maps to CWE-441 (Unintended Proxy or Intermediary, the 'confused deputy' class): a component with legitimate cross-segment reachability can be induced to forward or relay attacker traffic on the attacker's behalf. The affected component is identified in CPE as cpe:2.3:a:pronetiqs:panduit_intravue (all versions through 3.2.1a14). Because the proxying occurs at the application layer of a tool that is deliberately positioned to span IT and OT zones, the trust IntraVUE is granted becomes the mechanism that defeats segmentation controls such as firewalls, VLANs, and conduits between Purdue-model levels.
Know when Panduit Intravue gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Remote, low-complexity, unauthenticated proxy abuse (AV:N/AC:L/PR:N/UI:N); segmentation bypass reaches other systems, giving scope change (S:C) with high C/I/A on exposed OT assets.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
DescriptionCVE.org
Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, which would bypass OT segmentation.
Executive ViewAI
Pronetiqs (Panduit) IntraVUE 3.2.1a14 and earlier contains a critical network-segmentation bypass allowing unauthenticated remote attackers to relay traffic between isolated OT and IT segments, effectively neutralizing the network protections that isolate industrial control systems. Since IntraVUE typically bridges both network zones, compromising this visibility appliance exposes critical OT infrastructure to direct attack. No vendor patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) restrict IntraVUE's network egress via firewall rules to prevent relay of OT-bound traffic; (2) deploy a jump-server or bastion host between IntraVUE and OT segments to enforce application-layer inspection; (3) segment IntraVUE into a DMZ isolated from both IT and OT networks, requiring authenticated jump-host transit for any cross-zone access; (4) implement real-time monitoring and alerting for any unusual Layer 3/4 traffic patterns originating from IntraVUE; (5) maintain a complete asset inventory of devices reachable through IntraVUE to accelerate incident response if exploitation occurs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Panduit Intravue
View allSensitive information disclosure in Pronetiqs IntraVUE (marketed as Panduit IntraVUE) versions 3.2.1a14 and prior allows
Cleartext credential exposure in Pronetiqs IntraVUE (Panduit IntraVUE) versions 3.2.1a14 and prior allows an attacker to
Credential theft in Pronetiqs/Panduit IntraVUE (versions 3.2.1a14 and prior) stems from the use of a cryptographically w
Unauthenticated network asset discovery exposure in Pronetiqs IntraVUE (formerly Panduit IntraVUE) versions 3.2.1a14 and
Exploit-DB