PT-2025-22466 · Microsoft+3 · Windows+4

Published 2025-05-22 · Updated 2025-06-04 · CVE-2025-3939

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tridium Niagara Framework versions prior to 4.14.2, prior to 4.15.1, prior to 4.10.11 Tridium Niagara Enterprise Security versions prior to 4.14.2, prior to 4.15.1, prior to 4.10.11

Description The issue affects Tridium Niagara Framework and Tridium Niagara Enterprise Security on various operating systems, including Windows, Linux, and QNX, allowing for Cryptanalysis due to an Observable Response Discrepancy vulnerability.

Recommendations For Tridium Niagara Framework versions prior to 4.14.2, upgrade to version 4.14.2u2. For Tridium Niagara Framework versions prior to 4.15.1, upgrade to version 4.15.u1. For Tridium Niagara Framework versions prior to 4.10.11, upgrade to version 4.10u.11. For Tridium Niagara Enterprise Security versions prior to 4.14.2, upgrade to version 4.14.2u2. For Tridium Niagara Enterprise Security versions prior to 4.15.1, upgrade to version 4.15.u1. For Tridium Niagara Enterprise Security versions prior to 4.10.11, upgrade to version 4.10u.11.

Fix

Side Channel Attack

Weakness Enumeration

CWE-204

CWE-203

Related Identifiers

CVE-2025-3939

Affected Products

Linux

Qnx

Tridium Niagara Enterprise Security

Tridium Niagara Ax Framework

Windows

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-3939 · Security Note
• https://osv.dev/vulnerability/CVE-2025-3939 · Vendor Advisory
• https://honeywell.com/us/en/product-security#security-notices · Vendor Advisory
• https://docs.niagara-community.com/category/tech_bull · Vendor Advisory
• https://t.me/cvenotify/124652 · Telegram Post
• https://twitter.com/CVEnew/status/1925539507371401358 · Twitter Post