EUVD-2026-48448
GHSA-6rv9-fwg5-8g8w
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Encryption strength requirements
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 23, 2026
Credential theft in Pronetiqs/Panduit IntraVUE (versions 3.2.1a14 and prior) stems from the use of a cryptographically weak password hash, allowing an attacker who obtains the stored or transmitted hash to recover or replay administrator credentials via a pass-the-hash attack. The flaw affects the IntraVUE industrial network visualization platform and can yield full administrative access to the console. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vulnerability was coordinated through CISA ICS-CERT (advisory ICSA-26-204-04).
Earlier versions of this analysis (1)
Inadequate credential hashing in Pronetiqs IntraVUE (formerly Panduit IntraVUE) versions 3.2.1a14 and prior exposes administrator credentials to theft and reuse via weak hash cracking or pass-the-hash techniques. An attacker with low-privilege network access who can intercept or access stored credential material may escalate to full administrative control, achieving both high confidentiality and integrity impact on the affected system. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the vulnerability has been disclosed through a CISA ICS-CERT advisory, elevating its relevance for operational technology environments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Panduit Intravue gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Network-accessible but requires credential interception positioning (AC:H, AV:N); low-privilege prior access needed (PR:L); admin credential compromise yields full C:H and I:H with no availability effect.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
3DescriptionCVE.org
Pronetiqs IntraVUE versions 3.2.1a14 and prior have an inadequate encryption strength vulnerability which could allow an attacker to steal admin credentials via weak hash or a pass-the-hash attack.
Executive ViewAI
Panduit IntraVUE industrial network visualization platform (versions 3.2.1a14 and prior) contains a credential theft vulnerability enabling attackers possessing administrator password hashes to gain full console access to monitored infrastructure. Organizations running affected versions face critical operational exposure with no vendor patch currently available. This represents material risk to OT environments relying on IntraVUE for network management.
Within 24 hours, inventory all IntraVUE deployments and identify systems running version 3.2.1a14 or earlier; immediately restrict administrative console access to a secured jump host and implement network-level isolation of IntraVUE systems from production environments. Within 7 days, rotate all administrator credentials to invalidate any captured password hashes, enable comprehensive audit logging of authentication attempts and administrative actions, and contact Panduit directly for interim hardening guidance pending patch availability per ICSA-26-204-04. Within 30 days, prioritize deployment of any vendor-released security patch upon availability; if Panduit provides no patch timeline, evaluate alternative industrial network visualization platforms or migrate to an air-gapped deployment model to eliminate remote access risk.
Network isolation via dedicated jump host for all administrative access; comprehensive audit logging of authentication attempts and administrative activity; immediate rotation of all IntraVUE administrator credentials to invalidate captured password hashes; strict role-based access controls limiting console access to authorized personnel; egress filtering preventing potential credential exfiltration; and continuous monitoring for anomalous access patterns indicative of pass-the-hash exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Panduit Intravue
View allNetwork-segmentation bypass in Pronetiqs (Panduit) IntraVUE 3.2.1a14 and earlier lets a remote, unauthenticated attacker
Sensitive information disclosure in Pronetiqs IntraVUE (marketed as Panduit IntraVUE) versions 3.2.1a14 and prior allows
Cleartext credential exposure in Pronetiqs IntraVUE (Panduit IntraVUE) versions 3.2.1a14 and prior allows an attacker to
Unauthenticated network asset discovery exposure in Pronetiqs IntraVUE (formerly Panduit IntraVUE) versions 3.2.1a14 and
Exploit-DB