CISA ICSA-26-204-04: Panduit IntraVUE Vulnerabilities (Plaintext Passwords/CVE-2026-XXXX)

Vulnerability Overview Vulnerability Name: Panduit IntraVUE Release Date: July 23, 2026 Alert Code: ICSA-26-204-04 Related Topics: Industrial Control Systems Vulnerabilities, Industrial Control Systems Impact Scope Affected Versions: IntraVUE <= 3.2.1a14 CVSS Score: v3.10 Vendor: Pronetiqs Device: Panduit IntraVUE Vulnerability Details: - Plaintext storage of passwords - Unauthorized agents or man-in-the-middle (referred to as "confused deputies") - Leakage of sensitive system information to unauthorized control centers - Insufficient encryption strength Remediation Recommended Practices: - Minimize the network exposure of all control system devices and/or systems, ensuring they are not accessible from the internet. - Place control system networks and remote devices behind firewalls and isolate them from business networks. - Use more secure remote access methods, such as Virtual Private Networks (VPNs), when remote access is required, and recognize that VPNs may have vulnerabilities and should be updated to the latest version. - Organizations should conduct appropriate impact analysis and risk assessment before deploying defensive measures. - Implement recommended cybersecurity strategies to proactively defend ICS assets. - Follow internal procedures to report suspicious malicious activity and adhere to CISA's tracking and association procedures. - Do not click links or open attachments in unsolicited email messages. - Refer to information on avoiding email fraud and social engineering attacks. Additional Information Background: - Critical Infrastructure Sectors: Critical Manufacturing, Energy, Information Technology, and Water and Wastewater - Deployed Countries/Regions: Global - Company Headquarters Location: Netherlands Vulnerability List: - CVE-2026-40430 - CVE-2026-42933 - CVE-2026-44955 - CVE-2026-50044 - CVE-2026-28698 Acknowledgments: - Phlebas of Luminit reported these vulnerabilities to CISA. Revision History: - Initial Release Date: 2026-07-23 - Revision: 1 - Summary: Initial Release Tags Sectors: Critical Manufacturing Sector, Energy Sector, Information Technology Sector, and Water and Wastewater Systems Topics: Industrial Control Systems Vulnerabilities, Industrial Control Systems Related Advisories Weintek cMT3092X Johnson Controls C-CURE 9000 and Victor application server Rockwell Automation ThinManager MZ Automation lib60870 Legal Notice and Terms of Use This product is subject to this notice and the privacy and use policy. Feedback Please share your thoughts. We have recently updated our anonymous product survey, and your feedback is welcome. Related Advisories Weintek cMT3092X Johnson Controls C-CURE 9000 and Victor application server Rockwell Automation ThinManager MZ Automation lib60870 Back to Top Topics Highlights Resources and Tools News and Events Careers About CISA Central 1-844-Say-CISA contact@cisa.dhs.gov CISA.gov Official website of the U.S. Department of Homeland Security About CISA Budget and Performance OIG.gov FOIA Requests No FEAR Act Office of Inspector General Privacy Policy Subscribe White House USA.gov Website Feedback Social Media Facebook X LinkedIn YouTube RSS Search Search Share Facebook X LinkedIn Reddit Navigation Topics Highlights Resources and Tools News and Events Careers About Related Advisories Weintek cMT3092X Johnson Controls C-CURE 9000 and Victor application server Rockwell Automation ThinManager MZ Automation lib60870 Back to Top Topics Highlights Resources and Tools News and Events Careers About CISA Central 1-844-Say-CISA contact@cisa.dhs.gov CISA.gov Official website of the U.S. Department of Homeland Security About CISA Budget and Performance OIG.gov FOIA Requests No FEAR Act Office of Inspector General Privacy Policy Subscribe White House USA.gov Website Feedback Social Media Facebook X LinkedIn YouTube RSS Search Search Share Facebook X LinkedIn Reddit Navigation Topics Highlights Resources and Tools News and Events Careers About Related Advisories Weintek cMT3092X Johnson Controls C-CURE 9000 and Victor application server Rockwell Automation ThinManager MZ Automation lib60870 Back to Top Topics Highlights Resources and Tools News and Events Careers About CISA Central 1-844-Say-CISA contact@cisa.dhs.gov CISA.gov Official website of the U.S. Department of Homeland Security About CISA Budget and Performance OIG.gov FOIA Requests No FEAR Act Office of Inspector General Privacy Policy Subscribe White House USA.gov Website Feedback Social Media Facebook X LinkedIn YouTube RSS Search Search Share Facebook X LinkedIn Reddit Navigation Topics Highlights Resources and Tools News and Events Careers About Related Advisories Weintek cMT3092X Johnson Controls C-CURE 9000 and Victor application server Rockwell Automation ThinManager MZ Automation lib60870 Back to Top Topics Highlights Resources and Tools News and Events Careers About CISA Central 1-844-Say-CISA contact@cisa.dhs.gov CISA.gov Official website of the U.S. Department of Homeland Security About CISA

Goal Reached Thanks to every supporter — we hit 100%!

CISA ICSA-26-204-04: Panduit IntraVUE Vulnerabilities (Plaintext Passwords/CVE-2026-XXXX)

More from this source