CVE-2025-3940

Improper Use of Validation Framework vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://docs.niagara-community.com/category/tech_bull	Permissions Required
https://honeywell.com/us/en/product-security#security-notices	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:tridium:niagara:4.10u10:::::::*
	cpe:2.3:a:tridium:niagara:4.14u1:::::::*
	cpe:2.3:a:tridium:niagara:4.15:::::::*
	cpe:2.3:a:tridium:niagara_enterprise_security:4.10u10:::::::*
	cpe:2.3:a:tridium:niagara_enterprise_security:4.14u1:::::::*
	cpe:2.3:a:tridium:niagara_enterprise_security:4.15:::::::*

OR	cpe:2.3:o:blackberry:qnx:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

04 Jun 2025, 19:28

Type	Values Removed	Values Added
CPE		cpe:2.3:a:tridium:niagara_enterprise_security:4.10u10:::::::* cpe:2.3:a:tridium:niagara:4.14u1:::::::* cpe:2.3:o:blackberry:qnx:-:::::::* cpe:2.3:o:microsoft:windows:-:::::::* cpe:2.3:a:tridium:niagara:4.15:::::::* cpe:2.3:a:tridium:niagara_enterprise_security:4.15:::::::* cpe:2.3:a:tridium:niagara_enterprise_security:4.14u1:::::::* cpe:2.3:a:tridium:niagara:4.10u10:::::::* cpe:2.3:o:linux:linux_kernel:-:::::::*
First Time		Tridium Tridium niagara Blackberry Microsoft Linux Microsoft windows Linux linux Kernel Tridium niagara Enterprise Security Blackberry qnx
CWE		NVD-CWE-Other
References	~~() https://docs.niagara-community.com/category/tech_bull -~~	() https://docs.niagara-community.com/category/tech_bull - Permissions Required
References	~~() https://honeywell.com/us/en/product-security#security-notices -~~	() https://honeywell.com/us/en/product-security#security-notices - Vendor Advisory

23 May 2025, 15:55

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad por uso indebido del marco de validación en Tridium Niagara Framework (Windows, Linux, QNX) y Tridium Niagara Enterprise Security (Windows, Linux y QNX) permite la manipulación de datos de entrada. Este problema afecta a Niagara Framework: versiones anteriores a la 4.14.2, 4.15.1 y 4.10.11; y a Niagara Enterprise Security: versiones anteriores a la 4.14.2, 4.15.1 y 4.10.11. Tridium recomienda actualizar a las versiones 4.14.2u2, 4.15.u1 o 4.10u.11 de Niagara Framework y Enterprise Security.

22 May 2025, 13:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-22 13:15

Updated : 2025-06-04 19:28

NVD link : CVE-2025-3940

Mitre link : CVE-2025-3940

CVE.ORG link : CVE-2025-3940

JSON object : View

Products Affected

linux

linux_kernel

tridium

niagara_enterprise_security
niagara

blackberry

microsoft

windows

CWE

CWE-1173

Improper Use of Validation Framework

NVD-CWE-Other

{"id": "CVE-2025-3940", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@honeywell.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-05-22T13:15:56.870", "references": [{"url": "https://docs.niagara-community.com/category/tech_bull", "tags": ["Permissions Required"], "source": "psirt@honeywell.com"}, {"url": "https://honeywell.com/us/en/product-security#security-notices", "tags": ["Vendor Advisory"], "source": "psirt@honeywell.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@honeywell.com", "description": [{"lang": "en", "value": "CWE-1173"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Improper Use of Validation Framework vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."}, {"lang": "es", "value": "Vulnerabilidad por uso indebido del marco de validaci\u00f3n en Tridium Niagara Framework (Windows, Linux, QNX) y Tridium Niagara Enterprise Security (Windows, Linux y QNX) permite la manipulaci\u00f3n de datos de entrada. Este problema afecta a Niagara Framework: versiones anteriores a la 4.14.2, 4.15.1 y 4.10.11; y a Niagara Enterprise Security: versiones anteriores a la 4.14.2, 4.15.1 y 4.10.11. Tridium recomienda actualizar a las versiones 4.14.2u2, 4.15.u1 o 4.10u.11 de Niagara Framework y Enterprise Security."}], "lastModified": "2025-06-04T19:28:55.960", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tridium:niagara:4.10u10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0615B9FA-E837-4C21-8968-F3273718DF7D"}, {"criteria": "cpe:2.3:a:tridium:niagara:4.14u1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BEE26A6F-876E-450D-8A5F-EF4A3EF96A13"}, {"criteria": "cpe:2.3:a:tridium:niagara:4.15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00C6667A-9873-4A75-AB11-3427AA1E552D"}, {"criteria": "cpe:2.3:a:tridium:niagara_enterprise_security:4.10u10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E694C4DB-66F7-4753-81D8-9085B5E3A207"}, {"criteria": "cpe:2.3:a:tridium:niagara_enterprise_security:4.14u1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "506E75F5-D259-4BAC-9C1A-83C9AD54D608"}, {"criteria": "cpe:2.3:a:tridium:niagara_enterprise_security:4.15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6DF70636-5B89-4646-80F3-83C906B0EB3C"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:blackberry:qnx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3642981A-848E-4DEA-A904-A83B9ED4891D"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@honeywell.com"}

5.3 /10