Skip to main content

Panduit IntraVUE CVE-2026-44955

| EUVDEUVD-2026-48447 MEDIUM
Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)
2026-07-23 icscert GHSA-vjq3-pgwr-8v29
Information Disclosure Panduit Intravue
6.9
CVSS 4.0 · Vendor: icscert
Share

Severity by source

Vendor (icscert) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Network-reachable with no auth or complexity; only low confidentiality impact as asset metadata, not data exfiltration; no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
CVSS changed
Jul 23, 2026 - 23:22 NVD
5.3 (MEDIUM) 6.9 (MEDIUM)
Analysis Generated
Jul 23, 2026 - 22:48 vuln.today

DescriptionCVE.org

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could allow for asset discovery by unauthenticated users.

AnalysisAI

Unauthenticated network asset discovery exposure in Pronetiqs IntraVUE (formerly Panduit IntraVUE) versions 3.2.1a14 and prior allows remote unauthenticated attackers to enumerate sensitive system and network asset information via the application interface. In industrial control system (ICS) and OT environments where IntraVUE is typically deployed, the disclosed asset inventory - including device types, IP addresses, and network topology - provides adversaries with reconnaissance data directly applicable to follow-on ICS-targeted attacks. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify IntraVUE server on network
Exploit
Send unauthenticated HTTP request to asset endpoint
Execution
Retrieve OT device inventory and topology
Impact
Map ICS network for targeted follow-on attack
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No special conditions beyond network reachability to the IntraVUE server are required; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against the default application state of IntraVUE versions 3.2.1a14 and prior. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The official CVSS 3.1 base score of 5.3 (Medium) accurately reflects the limited direct technical impact - confidentiality is rated Low, with no integrity or availability impact - but this metric does not capture the operational risk profile of this vulnerability in its typical deployment context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with network access to the IntraVUE server - for example, through a compromised corporate IT network with a connection to the OT environment, or directly if the server is internet-exposed - sends unauthenticated HTTP requests to information-disclosure endpoints within the IntraVUE interface. The application responds with asset inventory data including discovered device names, IP addresses, device types, and network topology, which the attacker uses to map the industrial network for subsequent targeted intrusion or disruption activity. …
Remediation Consult CISA ICS Advisory ICSA-26-204-04 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-04) for vendor-specific patch guidance; a fixed version was not independently confirmed from the provided data, so administrators should contact Pronetiqs directly to obtain the patched release. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Panduit Intravue

View all
CVE-2026-42933 CRITICAL
10.0 Jul 23

Network-segmentation bypass in Pronetiqs (Panduit) IntraVUE 3.2.1a14 and earlier lets a remote, unauthenticated attacker
CVE-2026-28698 CRITICAL
9.2 Jul 23

Sensitive information disclosure in Pronetiqs IntraVUE (marketed as Panduit IntraVUE) versions 3.2.1a14 and prior allows
CVE-2026-40430 HIGH
8.7 Jul 23

Cleartext credential exposure in Pronetiqs IntraVUE (Panduit IntraVUE) versions 3.2.1a14 and prior allows an attacker to
CVE-2026-50044 HIGH
7.6 Jul 23

Credential theft in Pronetiqs/Panduit IntraVUE (versions 3.2.1a14 and prior) stems from the use of a cryptographically w

Same weakness CWE-497 – Exposure of Sensitive System Information to an Unauthorized Control Sphere

View all
CVE-2026-34413 HIGH POC
8.8
CVE-2026-41459 MEDIUM POC
6.9
CVE-2022-1902 HIGH POC
8.8
CVE-2022-4985 HIGH POC
8.7
CVE-2018-25358 HIGH POC
8.7
CVE-2020-36922 HIGH POC
7.5
CVE-2020-36926 HIGH POC
7.5
CVE-2026-28698 CRITICAL
9.2

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2026-44955 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy