EUVD-2026-48447
GHSA-vjq3-pgwr-8v29
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no auth or complexity; only low confidentiality impact as asset metadata, not data exfiltration; no integrity or availability effect.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could allow for asset discovery by unauthenticated users.
AnalysisAI
Unauthenticated network asset discovery exposure in Pronetiqs IntraVUE (formerly Panduit IntraVUE) versions 3.2.1a14 and prior allows remote unauthenticated attackers to enumerate sensitive system and network asset information via the application interface. In industrial control system (ICS) and OT environments where IntraVUE is typically deployed, the disclosed asset inventory - including device types, IP addresses, and network topology - provides adversaries with reconnaissance data directly applicable to follow-on ICS-targeted attacks. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Technical ContextAI
IntraVUE is an industrial network visualization and asset management platform historically developed by Panduit and now marketed under the Pronetiqs brand; CPE string cpe:2.3:a:pronetiqs:panduit_intravue:*:*:*:*:*:*:*:* confirms the affected software lineage. The root cause is classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), meaning the application exposes data - such as discovered OT/ICS asset inventories, network topology maps, or device metadata - through endpoints or interfaces that lack access controls. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the exposure is reachable over the network without any authentication or interaction, consistent with a web-accessible dashboard or API that omits authentication enforcement on information-retrieval endpoints. In ICS environments, this class of exposure is particularly sensitive because asset enumeration enables adversaries to profile industrial networks prior to operational disruption attempts.
RemediationAI
Consult CISA ICS Advisory ICSA-26-204-04 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-04) for vendor-specific patch guidance; a fixed version was not independently confirmed from the provided data, so administrators should contact Pronetiqs directly to obtain the patched release. As a compensating control pending patching, restrict network access to the IntraVUE application to authorized OT management networks only - place the IntraVUE server behind a firewall or DMZ that allows access only from defined administrator IP ranges, preventing unauthenticated external or lateral-movement access. If the application exposes a web interface, consider implementing a reverse proxy with authentication enforcement (e.g., HTTP basic auth or an SSO gateway) in front of it as an interim layer. Note that network segmentation is a temporary control and does not address the underlying lack of authentication in the application itself; upgrade to a patched version as soon as one is available.
More in Panduit Intravue
View allNetwork-segmentation bypass in Pronetiqs (Panduit) IntraVUE 3.2.1a14 and earlier lets a remote, unauthenticated attacker
Sensitive information disclosure in Pronetiqs IntraVUE (marketed as Panduit IntraVUE) versions 3.2.1a14 and prior allows
Cleartext credential exposure in Pronetiqs IntraVUE (Panduit IntraVUE) versions 3.2.1a14 and prior allows an attacker to
Credential theft in Pronetiqs/Panduit IntraVUE (versions 3.2.1a14 and prior) stems from the use of a cryptographically w
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today