Panduit IntraVUE: 5 CVEs, Critical 10.0
Summary
CISA reports 5 vulnerabilities in Pronetiqs IntraVUE. Weakness types: Plaintext Storage of a Password, Unintended Proxy or Intermediary ('Confused Deputy'), Exposure of Sensitive System Information to an Unauthorized Control Sphere (+1 more). Successful exploitation of these vulnerabilities could allow an attacker with access to the IT network to manipulate industrial control devices without requiring physical access, specialized insider knowledge, or advanced tooling. Highest CVSS v3 score: 10.0 (Critical), exploitable over the network.
At a glance
- Vendor
- Pronetiqs
- Products
- IntraVUE
- CVEs
- CVE-2026-40430, CVE-2026-42933, CVE-2026-44955, CVE-2026-50044, CVE-2026-28698
- Highest CVSS v3
- 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Energy, Information Technology, Water and Wastewater
- Deployed
- Worldwide
- Vendor HQ
- Netherlands
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-40430 | Plaintext Storage of a Password | 7.5 | – | No | Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API. |
| CVE-2026-42933 | Unintended Proxy or Intermediary ('Confused Deputy') | 10.0 | – | No | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, which would bypass OT segmentation. |
| CVE-2026-44955 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | 5.3 | – | No | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could allow for asset discovery by unauthenticated users. |
| CVE-2026-50044 | Inadequate Encryption Strength | 6.8 | – | No | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an inadequate encryption strength vulnerability which could allow an attacker to steal admin credentials via weak hash or a pass-the-hash attack. |
| CVE-2026-28698 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | 8.6 | – | No | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could expose the underlying host/share filesystem. |
Affected products (1)
- Pronetiqs IntraVUE: <=3.2.1a14
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Pronetiqs advises users to update to the latest version of the IntraVUE software, version 3.2.1a16 or later.
- Mitigation: For further questions, please contact Pronetiqs at [email protected]. link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.