Tridium Niagara Framework/Niagara Enterprise Security up to 4.10.10/4.14.1/4.15.0 permission assignment

Summaryinfo

A vulnerability, which was classified as critical, has been found in Tridium Niagara Framework and Niagara Enterprise Security up to 4.10.10/4.14.1/4.15.0. The affected element is an unknown function. Performing a manipulation results in permission assignment. This vulnerability is known as CVE-2025-3944. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Tridium Niagara Framework and Niagara Enterprise Security up to 4.10.10/4.14.1/4.15.0. It has been classified as critical. This affects an unknown functionality. The manipulation with an unknown input leads to a permission assignment vulnerability. CWE is classifying the issue as CWE-732. The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows File Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.

It is possible to read the advisory at honeywell.com. This vulnerability is uniquely identified as CVE-2025-3944 since 04/25/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. The exploitation requires an enhanced level of successful authentication. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 4.10.11, 4.14.2 or 4.15.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-16157). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Tridium

Name

• Niagara Enterprise Security
• Niagara Framework

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.10.0
• 4.10.1
• 4.10.2
• 4.10.3
• 4.10.4
• 4.10.5
• 4.10.6
• 4.10.7
• 4.10.8
• 4.10.9
• 4.10.10
• 4.11
• 4.12
• 4.13
• 4.14
• 4.14.0
• 4.14.1
• 4.15.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion