# Panduit IntraVUE ICS software has five flaws

Published: 2026-07-23 · Severity: medium · Sectors: manufacturing, energy, technology, infrastructure
Canonical: https://vorant.io/reports/0e8b3111-d8ef-5810-a001-ef2845fde9f0/panduit-intravue-ics-software-has-five-flaws

> CISA disclosed five vulnerabilities in Panduit IntraVUE ICS software that could expose credentials and enable OT network bypass, with no known active exploitation.

CISA published an ICS advisory detailing five vulnerabilities affecting Panduit IntraVUE (developed by Pronetiqs), versions 3.2.1a14 and prior, deployed worldwide across Critical Manufacturing, Energy, Information Technology, and Water and Wastewater sectors. The flaws include plaintext storage of passwords exposing credentials via the API, an unintended proxy/intermediary issue allowing bypass of OT network segmentation, exposure of sensitive system information enabling unauthenticated asset discovery and filesystem exposure, and inadequate encryption strength that could allow theft of admin credentials via weak hashing or pass-the-hash attacks.

Successful exploitation would allow an attacker with IT network access to manipulate industrial control devices without physical access or advanced tooling, posing risk primarily through credential theft and segmentation bypass rather than direct remote code execution. The vulnerabilities were reported to CISA by a researcher (Phlebas of Lumintel). Pronetiqs has released version 3.2.1a16 to remediate all five issues, and CISA states no known public exploitation has been reported at this time.

## Mentioned in this report

- Vulnerabilities: CVE-2026-28698, CVE-2026-40430, CVE-2026-42933, CVE-2026-44955, CVE-2026-50044

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-04

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/0e8b3111-d8ef-5810-a001-ef2845fde9f0/panduit-intravue-ics-software-has-five-flaws.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup