EUVD-2026-48446
GHSA-jp3p-8p4m-hxwj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, low-complexity, unauthenticated proxy abuse (AV:N/AC:L/PR:N/UI:N); segmentation bypass reaches other systems, giving scope change (S:C) with high C/I/A on exposed OT assets.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, which would bypass OT segmentation.
AnalysisAI
Network-segmentation bypass in Pronetiqs (Panduit) IntraVUE 3.2.1a14 and earlier lets a remote, unauthenticated attacker abuse the product as an active proxy/intermediary to relay traffic across otherwise-isolated OT boundaries. Because IntraVUE typically sits with visibility into both IT and industrial control network segments, this confused-deputy behavior effectively neutralizes the network zoning that protects OT assets. Rated CVSS 10.0 with a scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
IntraVUE is an industrial network device-discovery and topology-visualization platform used to map and monitor Ethernet/OT networks, which requires it to be reachable across multiple network segments. The flaw maps to CWE-441 (Unintended Proxy or Intermediary, the 'confused deputy' class): a component with legitimate cross-segment reachability can be induced to forward or relay attacker traffic on the attacker's behalf. The affected component is identified in CPE as cpe:2.3:a:pronetiqs:panduit_intravue (all versions through 3.2.1a14). Because the proxying occurs at the application layer of a tool that is deliberately positioned to span IT and OT zones, the trust IntraVUE is granted becomes the mechanism that defeats segmentation controls such as firewalls, VLANs, and conduits between Purdue-model levels.
RemediationAI
No vendor-released patch version is identified in the available data; consult CISA advisory ICSA-26-204-04 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-04) for the vendor's fixed build and upgrade guidance, and apply the vendor-remediated release as the primary fix once confirmed. In the interim, apply compensating controls consistent with ICS best practice: restrict network access to IntraVUE hosts and services so they are reachable only from a dedicated management segment or jump host (trade-off: legitimate operators must connect via that path), place IntraVUE behind an ICS-aware firewall and explicitly deny it from relaying traffic between IT and OT zones rather than relying on its own segmentation posture, and disable or block any inbound proxy/relay-capable interface that is not operationally required. Enforce that remote access to the OT environment uses hardened VPN and monitor IntraVUE for anomalous cross-segment connections. These controls reduce reachability but may complicate legitimate cross-segment discovery, which is IntraVUE's core function, so validate monitoring coverage after locking it down.
More in Panduit Intravue
View allSensitive information disclosure in Pronetiqs IntraVUE (marketed as Panduit IntraVUE) versions 3.2.1a14 and prior allows
Cleartext credential exposure in Pronetiqs IntraVUE (Panduit IntraVUE) versions 3.2.1a14 and prior allows an attacker to
Credential theft in Pronetiqs/Panduit IntraVUE (versions 3.2.1a14 and prior) stems from the use of a cryptographically w
Unauthenticated network asset discovery exposure in Pronetiqs IntraVUE (formerly Panduit IntraVUE) versions 3.2.1a14 and
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today