Panduit IntraVUE EUVD-2026-48445

Exploitation requires network reachability to the IntraVUE management API on an affected server (version 3.2.1a14 or prior); the credentials are exposed specifically through that API because they are stored in plaintext. The CVSS 4.0 vector states PR:N/UI:N (no privileges and no user interaction), implying the API disclosure path is reachable without authentication against affected builds - however, the description does not confirm whether the API endpoint enforces a session, so if authentication is in fact required this becomes an authenticated disclosure; verify with the ICS-CERT advisory. The principal limiting factor is network exposure of the API: deployments that segment or firewall the IntraVUE server off from untrusted networks substantially reduce reachability.

The supplied CVSS 4.0 base score is 8.7 (High) with vector AV:N/AC:L/AT:N/PR:N/UI:N and VC:H/VI:N/VA:N, indicating a network-reachable, low-complexity confidentiality-only disclosure requiring no privileges or user interaction. No EPSS score was provided, so exploitation probability cannot be quantified, and the CVE is not in CISA KEV, so there is no evidence of active exploitation - the signals are consistent with a serious but not yet demonstrably exploited weakness. One point warrants verification: the CVSS marks PR:N (unauthenticated), yet the description says exposure occurs 'through the API,' and many management APIs require a session - if the API endpoint enforces authentication, real-world attack surface is narrower than PR:N implies; confirm with the vendor/ICS-CERT advisory. Because this is confidentiality-only (VI:N/VA:N), the direct impact is credential leakage, but harvested cleartext credentials commonly enable follow-on lateral movement, making the practical risk higher than an isolated info-disclosure.

An attacker with network reachability to the IntraVUE server queries the affected API endpoint and receives stored account passwords in cleartext, then reuses those credentials to authenticate to IntraVUE or connected industrial systems. Given AC:L and no required user interaction, the request is straightforward once the endpoint is reachable; no public exploit code has been identified at time of analysis.