PT-2012-4446 · Tridium · Tridium Niagara Ax Framework

Published 2012-08-16 · Updated 2023-03-22 · CVE-2012-3025

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tridium Niagara AX Framework versions prior to 3.7

Description The issue concerns the default configuration of the software, which uses a cleartext base64 format for transmitting credentials in cookies. This allows remote attackers to obtain sensitive information by sniffing the network.

Recommendations For versions prior to 3.7, update to version 3.7 or later to resolve the issue.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2012-3025

Affected Products

Tridium Niagara Ax Framework

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2012-3025 · Security Note
• http://tridium.com/cs/tridium_news/security_patch_36 · Vendor Advisory
• http://us-cert.gov/control_systems/pdf/ICSA-12-228-01.pdf · Note