Tridium Niagara Enterprise Security vulnerabilities

CVE-2025-3945 [CRITICAL] CWE-88 CVE-2025-3945: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows Command Delimiters. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before

CVE-2025-3944 [CRITICAL] CWE-732 CVE-2025-3944: Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows File Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends

CVE-2025-3936 [CRITICAL] CWE-732 CVE-2025-3936: Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.1

CVE-2025-3941 [CRITICAL] CWE-69 CVE-2025-3941: Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.Tr

CVE-2025-3938 [CRITICAL] CWE-325 CVE-2025-3938: Missing Cryptographic Step vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridiu Missing Cryptographic Step vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommend

CVE-2025-3940 [CRITICAL] CWE-1173 CVE-2025-3940: Improper Use of Validation Framework vulnerability in Tridium Niagara Framework on Windows, Linux, Q Improper Use of Validation Framework vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.

CVE-2025-3937 [CRITICAL] CWE-916 CVE-2025-3937: Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framewo Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1,

CVE-2025-3943 [HIGH] CWE-598 CVE-2025-3943: Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Parameter Injection. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, bef

CVE-2025-3942 [HIGH] CWE-117 CVE-2025-3942: Improper Output Neutralization for Logs vulnerability in Tridium Niagara Framework on Windows, Linux Improper Output Neutralization for Logs vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11

CVE-2025-3939 [MEDIUM] CWE-204 CVE-2025-3939: Observable Response Discrepancy vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, T Observable Response Discrepancy vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.Tridium recomme

CVE-2018-18985 [MEDIUM] CWE-79 CVE-2018-18985: Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all ve Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4 a cross-site scripting vulnerability has been identified that may allow a remote attacker to inject code to some web pages a

CVE-2020-14483 [MEDIUM] CWE-1088 CVE-2020-14483: A timeout during a TLS handshake can result in the connection failing to terminate. This can result A timeout during a TLS handshake can result in the connection failing to terminate. This can result in a Niagara thread hanging and requires a manual restart of Niagara (Versions 4.6.96.28, 4.7.109.20, 4.7.110.32, 4.8.0.110) and Niagara Enterprise Security (Versions 2.4.31, 2.4.45, 4.8.0.35) to correct.