Missing Cryptographic Step in Tridium Niagara Framework and Enterprise Security
CVE-2025-3938

9.8CRITICAL

Key Information:

Vendor

Tridium

Status
Niagara Framework
Niagara Enterprise Security
Vendor
CVE Published:
22 May 2025

What is CVE-2025-3938?

A cryptographic vulnerability exists in the Tridium Niagara Framework and Niagara Enterprise Security, affecting multiple OS environments, including Windows, Linux, and QNX. This vulnerability due to a missing critical cryptographic step allows for potential cryptanalysis, which may compromise data integrity and confidentiality. Tridium strongly advises users to upgrade to the latest versions: Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11 to mitigate this issue.

Affected Version(s)

Niagara Enterprise Security Windows 0

Niagara Enterprise Security Windows 0 < 4.14.2

Niagara Enterprise Security Windows 0 < 4.15.1

References

https://www.honeywell.com/us/en/product-security#security...
vendor-advisory
https://docs.niagara-community.com/category/tech_bull
vendor-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrea Palanca and team at Nozomi Networks
.