Panduit Intravue
Monthly
Sensitive information disclosure in Pronetiqs IntraVUE (marketed as Panduit IntraVUE) versions 3.2.1a14 and prior allows remote unauthenticated attackers to read the underlying host and network share filesystem through the industrial-network visualization application. Rated CVSS 4.0 9.2 (Critical) by ICS-CERT, the flaw exposes files outside the application's intended access boundary. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-facing, no-authentication profile makes it a high-priority patch for OT environments.
Credential theft in Pronetiqs/Panduit IntraVUE (versions 3.2.1a14 and prior) stems from the use of a cryptographically weak password hash, allowing an attacker who obtains the stored or transmitted hash to recover or replay administrator credentials via a pass-the-hash attack. The flaw affects the IntraVUE industrial network visualization platform and can yield full administrative access to the console. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vulnerability was coordinated through CISA ICS-CERT (advisory ICSA-26-204-04).
Unauthenticated network asset discovery exposure in Pronetiqs IntraVUE (formerly Panduit IntraVUE) versions 3.2.1a14 and prior allows remote unauthenticated attackers to enumerate sensitive system and network asset information via the application interface. In industrial control system (ICS) and OT environments where IntraVUE is typically deployed, the disclosed asset inventory - including device types, IP addresses, and network topology - provides adversaries with reconnaissance data directly applicable to follow-on ICS-targeted attacks. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Network-segmentation bypass in Pronetiqs (Panduit) IntraVUE 3.2.1a14 and earlier lets a remote, unauthenticated attacker abuse the product as an active proxy/intermediary to relay traffic across otherwise-isolated OT boundaries. Because IntraVUE typically sits with visibility into both IT and industrial control network segments, this confused-deputy behavior effectively neutralizes the network zoning that protects OT assets. Rated CVSS 10.0 with a scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cleartext credential exposure in Pronetiqs IntraVUE (Panduit IntraVUE) versions 3.2.1a14 and prior allows an attacker to retrieve stored passwords in plaintext via the product's API, because credentials are never hashed or encrypted at rest. This industrial-network visualization tool is affected across all builds up to and including 3.2.1a14, and per the CVSS 4.0 vector the disclosure is reachable over the network without authentication (VC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the ICS-CERT advisory (ICSA-26-204-04) confirms the flaw.
Sensitive information disclosure in Pronetiqs IntraVUE (marketed as Panduit IntraVUE) versions 3.2.1a14 and prior allows remote unauthenticated attackers to read the underlying host and network share filesystem through the industrial-network visualization application. Rated CVSS 4.0 9.2 (Critical) by ICS-CERT, the flaw exposes files outside the application's intended access boundary. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-facing, no-authentication profile makes it a high-priority patch for OT environments.
Credential theft in Pronetiqs/Panduit IntraVUE (versions 3.2.1a14 and prior) stems from the use of a cryptographically weak password hash, allowing an attacker who obtains the stored or transmitted hash to recover or replay administrator credentials via a pass-the-hash attack. The flaw affects the IntraVUE industrial network visualization platform and can yield full administrative access to the console. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vulnerability was coordinated through CISA ICS-CERT (advisory ICSA-26-204-04).
Unauthenticated network asset discovery exposure in Pronetiqs IntraVUE (formerly Panduit IntraVUE) versions 3.2.1a14 and prior allows remote unauthenticated attackers to enumerate sensitive system and network asset information via the application interface. In industrial control system (ICS) and OT environments where IntraVUE is typically deployed, the disclosed asset inventory - including device types, IP addresses, and network topology - provides adversaries with reconnaissance data directly applicable to follow-on ICS-targeted attacks. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Network-segmentation bypass in Pronetiqs (Panduit) IntraVUE 3.2.1a14 and earlier lets a remote, unauthenticated attacker abuse the product as an active proxy/intermediary to relay traffic across otherwise-isolated OT boundaries. Because IntraVUE typically sits with visibility into both IT and industrial control network segments, this confused-deputy behavior effectively neutralizes the network zoning that protects OT assets. Rated CVSS 10.0 with a scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cleartext credential exposure in Pronetiqs IntraVUE (Panduit IntraVUE) versions 3.2.1a14 and prior allows an attacker to retrieve stored passwords in plaintext via the product's API, because credentials are never hashed or encrypted at rest. This industrial-network visualization tool is affected across all builds up to and including 3.2.1a14, and per the CVSS 4.0 vector the disclosure is reachable over the network without authentication (VC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the ICS-CERT advisory (ICSA-26-204-04) confirms the flaw.