CVE-2025-3940

Improper Use of Validation Framework vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://docs.niagara-community.com/category/tech_bull	Permissions Required
https://honeywell.com/us/en/product-security#security-notices	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:tridium:niagara:4.10u10:::::::*
	cpe:2.3:a:tridium:niagara:4.14u1:::::::*
	cpe:2.3:a:tridium:niagara:4.15:::::::*
	cpe:2.3:a:tridium:niagara_enterprise_security:4.10u10:::::::*
	cpe:2.3:a:tridium:niagara_enterprise_security:4.14u1:::::::*
	cpe:2.3:a:tridium:niagara_enterprise_security:4.15:::::::*

OR	cpe:2.3:o:blackberry:qnx:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

No history.

Information

Published : 2025-05-22 13:15

Updated : 2025-06-04 19:28

NVD link : CVE-2025-3940

Mitre link : CVE-2025-3940

CVE.ORG link : CVE-2025-3940

JSON object : View

Products Affected

tridium

niagara
niagara_enterprise_security

microsoft

windows

linux

linux_kernel

blackberry

qnx

CWE

CWE-1173

Improper Use of Validation Framework

NVD-CWE-Other

{"id": "CVE-2025-3940", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@honeywell.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-05-22T13:15:56.870", "references": [{"url": "https://docs.niagara-community.com/category/tech_bull", "tags": ["Permissions Required"], "source": "psirt@honeywell.com"}, {"url": "https://honeywell.com/us/en/product-security#security-notices", "tags": ["Vendor Advisory"], "source": "psirt@honeywell.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@honeywell.com", "description": [{"lang": "en", "value": "CWE-1173"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Improper Use of Validation Framework vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."}, {"lang": "es", "value": "Vulnerabilidad por uso indebido del marco de validaci\u00f3n en Tridium Niagara Framework (Windows, Linux, QNX) y Tridium Niagara Enterprise Security (Windows, Linux y QNX) permite la manipulaci\u00f3n de datos de entrada. Este problema afecta a Niagara Framework: versiones anteriores a la 4.14.2, 4.15.1 y 4.10.11; y a Niagara Enterprise Security: versiones anteriores a la 4.14.2, 4.15.1 y 4.10.11. Tridium recomienda actualizar a las versiones 4.14.2u2, 4.15.u1 o 4.10u.11 de Niagara Framework y Enterprise Security."}], "lastModified": "2025-06-04T19:28:55.960", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tridium:niagara:4.10u10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0615B9FA-E837-4C21-8968-F3273718DF7D"}, {"criteria": "cpe:2.3:a:tridium:niagara:4.14u1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BEE26A6F-876E-450D-8A5F-EF4A3EF96A13"}, {"criteria": "cpe:2.3:a:tridium:niagara:4.15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00C6667A-9873-4A75-AB11-3427AA1E552D"}, {"criteria": "cpe:2.3:a:tridium:niagara_enterprise_security:4.10u10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E694C4DB-66F7-4753-81D8-9085B5E3A207"}, {"criteria": "cpe:2.3:a:tridium:niagara_enterprise_security:4.14u1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "506E75F5-D259-4BAC-9C1A-83C9AD54D608"}, {"criteria": "cpe:2.3:a:tridium:niagara_enterprise_security:4.15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6DF70636-5B89-4646-80F3-83C906B0EB3C"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:blackberry:qnx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3642981A-848E-4DEA-A904-A83B9ED4891D"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@honeywell.com"}