Panduit IntraVUE CVE-2026-44955

No special conditions beyond network reachability to the IntraVUE server are required; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against the default application state of IntraVUE versions 3.2.1a14 and prior. Exploitation is limited by network topology: the IntraVUE server must be reachable from the attacker's position (direct internet exposure or lateral movement from an IT network into the OT segment). The vulnerability does not require any specific configuration mode, feature enablement, or user interaction. The impact is bounded to confidentiality of system/asset information; no integrity or availability impact is in scope. The specific nature of the exposed information endpoints is not described in available advisory data beyond 'sensitive system information' and the ICS asset discovery context implied by the product function.

The official CVSS 3.1 base score of 5.3 (Medium) accurately reflects the limited direct technical impact - confidentiality is rated Low, with no integrity or availability impact - but this metric does not capture the operational risk profile of this vulnerability in its typical deployment context. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivial remote unauthenticated exploitation with no attack complexity barriers, which elevates practical reachability. No EPSS score was provided in the supplied data, so exploitation probability cannot be quantitatively assessed. KEV status is negative and no public POC has been identified, placing this in a lower-urgency tier absent targeted threat intelligence. However, because IntraVUE is an ICS asset management tool, the sensitive system information it exposes - OT network topology, device inventory, PLC/HMI identifiers - has direct reconnaissance value for threat actors targeting industrial environments, making the real-world consequence potentially disproportionate to the CVSS score. Organizations in critical infrastructure sectors (manufacturing, energy, water) should treat this as higher priority than the base score implies. No conflicting signals were identified between data sources.

An attacker with network access to the IntraVUE server - for example, through a compromised corporate IT network with a connection to the OT environment, or directly if the server is internet-exposed - sends unauthenticated HTTP requests to information-disclosure endpoints within the IntraVUE interface. The application responds with asset inventory data including discovered device names, IP addresses, device types, and network topology, which the attacker uses to map the industrial network for subsequent targeted intrusion or disruption activity. No public exploit code has been identified, but the low attack complexity means any attacker with network visibility to the server can perform this reconnaissance without tooling beyond a standard browser or HTTP client.