CVE-2025-3938

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-3938
Missing Cryptographic Step vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.

6.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://docs.niagara-community.com/category/tech_bull Permissions Required
https://www.honeywell.com/us/en/product-security#security-notices Vendor Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:tridium:niagara:4.10u10:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagara:4.14u1:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagara:4.15:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagara_enterprise_security:4.10u10:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagara_enterprise_security:4.14u1:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagara_enterprise_security:4.15:*:*:*:*:*:*:*
OR cpe:2.3:o:blackberry:qnx:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
History

04 Jun 2025, 19:29

Type Values Removed Values Added
CWE CWE-327
References () https://docs.niagara-community.com/category/tech_bull - () https://docs.niagara-community.com/category/tech_bull - Permissions Required
References () https://www.honeywell.com/us/en/product-security#security-notices - () https://www.honeywell.com/us/en/product-security#security-notices - Vendor Advisory
CPE cpe:2.3:a:tridium:niagara_enterprise_security:4.10u10:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagara:4.14u1:*:*:*:*:*:*:*
cpe:2.3:o:blackberry:qnx:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagara:4.15:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagara_enterprise_security:4.15:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagara_enterprise_security:4.14u1:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagara:4.10u10:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
First Time Tridium
Tridium niagara
Blackberry
Microsoft
Linux
Microsoft windows
Linux linux Kernel
Tridium niagara Enterprise Security
Blackberry qnx

23 May 2025, 15:55

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de paso criptográfico faltante en Tridium Niagara Framework para Windows, Linux y QNX, Tridium Niagara Enterprise Security para Windows, Linux y QNX permite el criptoanálisis. Este problema afecta a Niagara Framework: versiones anteriores a la 4.14.2, 4.15.1 y 4.10.11; Niagara Enterprise Security: versiones anteriores a la 4.14.2, 4.15.1 y 4.10.11. Tridium recomienda actualizar a las versiones 4.14.2u2, 4.15.u1 o 4.10u.11 de Niagara Framework y Enterprise Security.

22 May 2025, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-22 13:15

Updated : 2025-06-04 19:29

NVD link : CVE-2025-3938

Mitre link : CVE-2025-3938

CVE.ORG link : CVE-2025-3938

JSON object : View

Products Affected

tridium

  • niagara
  • niagara_enterprise_security

microsoft

  • windows

linux

  • linux_kernel

blackberry

  • qnx
CWE
CWE-325

Missing Cryptographic Step

CWE-327

Use of a Broken or Risky Cryptographic Algorithm