Pronetiqs IntraVUE versions 3.2.1a14 and earlier allow an unauthorized control sphere to expose sensitive system information, including the underlying host and shared filesystem. This disclosure could enable an attacker to gather detailed configuration and potentially plan further attacks. The vulnerability is classified as CWE-497, a vulnerability involving improper protection of privileged information, posing a significant confidentiality risk.

The affected products are Panduit IntraVUE software supplied by Pronetiqs. All releases up to and including version 3.2.1a14 are impacted, while version 3.2.1a16 and later contain the fix.

With a CVSS score of 9.2 the vulnerability is considered critical. The EPSS score of less than 1% indicates a low probability of exploitation in the wild at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the control interface that an unauthorized entity can access; while the exact prerequisites are not detailed, it is inferred that possessing access to the control sphere is sufficient to trigger the information leakage.