Tridium Niagara Framework/Niagara Enterprise Security up to 4.10.10/4.14.1/4.15.0 Password Hash weak password hash

Summaryinfo

A vulnerability categorized as problematic has been discovered in Tridium Niagara Framework and Niagara Enterprise Security up to 4.10.10/4.14.1/4.15.0. Affected is an unknown function of the component Password Hash Handler. Such manipulation leads to weak password hash. This vulnerability is listed as CVE-2025-3937. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Tridium Niagara Framework and Niagara Enterprise Security up to 4.10.10/4.14.1/4.15.0. It has been rated as problematic. Affected by this issue is an unknown functionality of the component Password Hash Handler. The manipulation with an unknown input leads to a weak password hash vulnerability. Using CWE to declare the problem leads to CWE-916. The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive. Impacted is confidentiality. CVE summarizes:

Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.

The advisory is shared for download at docs.niagara-community.com. This vulnerability is handled as CVE-2025-3937 since 04/25/2025. The exploitation is known to be difficult. The attack may be launched remotely. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1552.

Upgrading to version 4.10.11, 4.14.2 or 4.15.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Tridium

Name

• Niagara Enterprise Security
• Niagara Framework

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.10.0
• 4.10.1
• 4.10.2
• 4.10.3
• 4.10.4
• 4.10.5
• 4.10.6
• 4.10.7
• 4.10.8
• 4.10.9
• 4.10.10
• 4.11
• 4.12
• 4.13
• 4.14
• 4.14.0
• 4.14.1
• 4.15.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion