CVE-2025-3942

Improper Output Neutralization for Logs vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.honeywell.com/us/en/product-security#security-notices	Vendor Advisory
https://www.tridium.com/us/en/product-security	Product

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:tridium:niagara:4.10u10:::::::*
	cpe:2.3:a:tridium:niagara:4.14u1:::::::*
	cpe:2.3:a:tridium:niagara:4.15:::::::*
	cpe:2.3:a:tridium:niagara_enterprise_security:4.10u10:::::::*
	cpe:2.3:a:tridium:niagara_enterprise_security:4.14u1:::::::*
	cpe:2.3:a:tridium:niagara_enterprise_security:4.15:::::::*

OR	cpe:2.3:o:blackberry:qnx:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

04 Jun 2025, 19:27

Type	Values Removed	Values Added
CWE		CWE-116
First Time		Linux Tridium niagara Enterprise Security Blackberry Tridium niagara Linux linux Kernel Microsoft windows Microsoft Tridium Blackberry qnx
CPE		cpe:2.3:a:tridium:niagara_enterprise_security:4.15:::::::* cpe:2.3:a:tridium:niagara:4.10u10:::::::* cpe:2.3:a:tridium:niagara:4.14u1:::::::* cpe:2.3:o:linux:linux_kernel:-:::::::* cpe:2.3:a:tridium:niagara:4.15:::::::* cpe:2.3:o:blackberry:qnx:-:::::::* cpe:2.3:o:microsoft:windows:-:::::::* cpe:2.3:a:tridium:niagara_enterprise_security:4.14u1:::::::* cpe:2.3:a:tridium:niagara_enterprise_security:4.10u10:::::::*
References	~~() https://www.honeywell.com/us/en/product-security#security-notices -~~	() https://www.honeywell.com/us/en/product-security#security-notices - Vendor Advisory
References	~~() https://www.tridium.com/us/en/product-security -~~	() https://www.tridium.com/us/en/product-security - Product

23 May 2025, 15:55

Type	Values Removed	Values Added
Summary		(es) La vulnerabilidad de neutralización de salida incorrecta para registros en Tridium Niagara Framework (Windows, Linux, QNX) y Tridium Niagara Enterprise Security (Windows, Linux, QNX) permite la manipulación de datos de entrada. Este problema afecta a Niagara Framework: versiones anteriores a la 4.14.2, 4.15.1 y 4.10.11; y a Niagara Enterprise Security: versiones anteriores a la 4.14.2, 4.15.1 y 4.10.11. Tridium recomienda actualizar a las versiones 4.14.2u2, 4.15.u1 o 4.10u.11 de Niagara Framework y Enterprise Security.

22 May 2025, 13:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-22 13:15

Updated : 2025-06-04 19:27

NVD link : CVE-2025-3942

Mitre link : CVE-2025-3942

CVE.ORG link : CVE-2025-3942

JSON object : View

Products Affected

tridium

niagara_enterprise_security
niagara

linux

linux_kernel

microsoft

windows

blackberry

CWE

CWE-117

Improper Output Neutralization for Logs

CWE-116

Improper Encoding or Escaping of Output

{"id": "CVE-2025-3942", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@honeywell.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2025-05-22T13:15:57.123", "references": [{"url": "https://www.honeywell.com/us/en/product-security#security-notices", "tags": ["Vendor Advisory"], "source": "psirt@honeywell.com"}, {"url": "https://www.tridium.com/us/en/product-security", "tags": ["Product"], "source": "psirt@honeywell.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@honeywell.com", "description": [{"lang": "en", "value": "CWE-117"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-116"}]}], "descriptions": [{"lang": "en", "value": "Improper Output Neutralization for Logs vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."}, {"lang": "es", "value": "La vulnerabilidad de neutralizaci\u00f3n de salida incorrecta para registros en Tridium Niagara Framework (Windows, Linux, QNX) y Tridium Niagara Enterprise Security (Windows, Linux, QNX) permite la manipulaci\u00f3n de datos de entrada. Este problema afecta a Niagara Framework: versiones anteriores a la 4.14.2, 4.15.1 y 4.10.11; y a Niagara Enterprise Security: versiones anteriores a la 4.14.2, 4.15.1 y 4.10.11. Tridium recomienda actualizar a las versiones 4.14.2u2, 4.15.u1 o 4.10u.11 de Niagara Framework y Enterprise Security."}], "lastModified": "2025-06-04T19:27:59.903", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tridium:niagara:4.10u10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0615B9FA-E837-4C21-8968-F3273718DF7D"}, {"criteria": "cpe:2.3:a:tridium:niagara:4.14u1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BEE26A6F-876E-450D-8A5F-EF4A3EF96A13"}, {"criteria": "cpe:2.3:a:tridium:niagara:4.15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00C6667A-9873-4A75-AB11-3427AA1E552D"}, {"criteria": "cpe:2.3:a:tridium:niagara_enterprise_security:4.10u10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E694C4DB-66F7-4753-81D8-9085B5E3A207"}, {"criteria": "cpe:2.3:a:tridium:niagara_enterprise_security:4.14u1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "506E75F5-D259-4BAC-9C1A-83C9AD54D608"}, {"criteria": "cpe:2.3:a:tridium:niagara_enterprise_security:4.15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6DF70636-5B89-4646-80F3-83C906B0EB3C"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:blackberry:qnx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3642981A-848E-4DEA-A904-A83B9ED4891D"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@honeywell.com"}

4.3 /10