Latest Tridium Niagara vulnerabilities #
Tridium (a Honeywell company) has disclosed ten vulnerabilities in certain versions of Niagara Framework and Niagara Enterprise Security.
- The use of a password hash with insufficient computational effort leaves the system susceptible to cryptanalysis by an adversary. This vulnerability has been designated CVE-2025-3937 and has been rated high with a CVSS score of 7.7.
- Incorrect permission assignment for critical system resources may allow an adversary to manipulate sensitive files, potentially leading to unauthorized data alteration, system instability, or privilege escalation. This vulnerability has been designated CVE-2025-3944 and has been rated high with a CVSS score of 7.2.
- Argument delimiters are not properly neutralized potentially allowing an adversary to inject argument and control the executed command. This vulnerability has been designated CVE-2025-3945 and has been rated high with a CVSS score of 7.2.
- A critical cryptographic step was omitted or incorrectly performed undermining the security strength and leaves the system susceptible to cryptanalysis by an adversary. This vulnerability has been designated CVE-2025-3938 and has been rated medium with a CVSS score of 6.8.
- Incorrect permission assignment for a critical resource may be exploited allowing an adversary to bypass intended access control security levels, potentially leading to unauthorized access, modification, or deletion of a security-critical resource. This vulnerability has been designated CVE-2025-3936 and has been rated medium with a CVSS score of 6.5.
- Improper handling of the Windows ::DATA Alternate Data Stream (ADS) may allow an adversary to manipulate input data, potentially leading to unexpected application behavior. This vulnerability has been designated CVE-2025-3941 and has been rated medium with a CVSS score of 5.4.
- Through observable discrepancies in system responses when processing cryptographic operations or sensitive data, this vulnerability leaves the system susceptible to cryptanalysis by an adversary. This vulnerability has been designated CVE-2025-3939 and has been rated medium with a CVSS score of 5.3.
- Incorrect or insufficient use of an input validation framework allows an adversary to manipulate input data, circumventing intended security checks and potentially leading to other issues. This vulnerability has been designated CVE-2025-3940 and has been rated medium with a CVSS score of 5.3.
- Improper neutralization of untrusted input when writing data to log files may allow an adversary to inject malicious data into log entries. This vulnerability has been designated CVE-2025-3942 and has been rated medium with a CVSS score of 4.3.
- The anti-CSRF refresh token appears within HTTP GET request query strings allowing an adversary to potentially capture the sensitive parameter and perform parameter injection attacks. This vulnerability has been designated CVE-2025-3943 and has been rated medium with a CVSS score of 4.1.
The following versions are affected
- Niagara Framework and Niagara Enterprise Security versions 0 through 4.10.10 (4.10u10)
- Niagara Framework and Niagara Enterprise Security versions 0 through 4.14.1 (4.14u1)
- Niagara Framework and Niagara Enterprise Security versions 0 through 4.15
What is the impact? #
A proposed exploit chain involving two of these vulnerabilities (CVE-2025-3943, CVE-2025-3944) carries a prerequisite that the Niagara system has been misconfigured, disabling encryption on a Niagara device. This misconfiguration should produce a warning on the security dashboard, which would need to remain unaddressed by system administrators. Successful exploitation of these vulnerabilities, under specific conditions, could enable an adjacent adversary to compromise both the Station and Platform environments, and achieve arbitrary code execution on the device.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- Niagara Framework and Niagara Enterprise Security to version 4.10.11 (4.10u11) and later releases
- Niagara Framework and Niagara Enterprise Security to version 4.14.2 (4.14u2) and later releases
- Niagara Framework and Niagara Enterprise Security to version 4.15.1 (4.15u1) and later releases
How to find potentially vulnerable systems with runZero #
From the Asset Inventory, use the following query to locate potentially vulnerable assets:
os:Tridium hw:NiagaraAbout runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.