PT-2025-22467 · Microsoft+3 · Windows+4

Published 2025-05-22 · Updated 2025-06-04 · CVE-2025-3940

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tridium Niagara Framework versions prior to 4.14.2, prior to 4.15.1, prior to 4.10.11 Tridium Niagara Enterprise Security versions prior to 4.14.2, prior to 4.15.1, prior to 4.10.11

Description The issue is related to the improper use of a validation framework, allowing input data manipulation. This affects Tridium Niagara Framework and Tridium Niagara Enterprise Security on various operating systems, including Windows, Linux, and QNX.

Recommendations For Tridium Niagara Framework versions prior to 4.14.2, upgrade to version 4.14.2u2. For Tridium Niagara Framework versions prior to 4.15.1, upgrade to version 4.15.u1. For Tridium Niagara Framework versions prior to 4.10.11, upgrade to version 4.10u.11. For Tridium Niagara Enterprise Security versions prior to 4.14.2, upgrade to version 4.14.2u2. For Tridium Niagara Enterprise Security versions prior to 4.15.1, upgrade to version 4.15.u1. For Tridium Niagara Enterprise Security versions prior to 4.10.11, upgrade to version 4.10u.11.

Fix

Weakness Enumeration

CWE-1173

Related Identifiers

CVE-2025-3940

Affected Products

Linux

Qnx

Tridium Niagara Enterprise Security

Tridium Niagara Ax Framework

Windows

References · 6

• https://osv.dev/vulnerability/CVE-2025-3940 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3940 · Security Note
• https://honeywell.com/us/en/product-security#security-notices · Vendor Advisory
• https://docs.niagara-community.com/category/tech_bull · Vendor Advisory
• https://t.me/cvenotify/124653 · Telegram Post
• https://twitter.com/CVEnew/status/1925539506352267636 · Twitter Post