PT-2025-22469 · Tridium · Tridium Niagara Ax Framework+1

Published 2025-05-22 · Updated 2025-05-22 · CVE-2025-3942

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Tridium Niagara Framework versions prior to 4.14.2, prior to 4.15.1, prior to 4.10.11 Tridium Niagara Enterprise Security versions prior to 4.14.2, prior to 4.15.1, prior to 4.10.11

Description The issue affects Tridium Niagara Framework and Tridium Niagara Enterprise Security on Windows, Linux, QNX, allowing Input Data Manipulation due to Improper Output Neutralization for Logs.

Recommendations For Tridium Niagara Framework versions prior to 4.14.2, upgrade to version 4.14.2u2. For Tridium Niagara Framework versions prior to 4.15.1, upgrade to version 4.15.u1. For Tridium Niagara Framework versions prior to 4.10.11, upgrade to version 4.10u.11. For Tridium Niagara Enterprise Security versions prior to 4.14.2, upgrade to version 4.14.2u2. For Tridium Niagara Enterprise Security versions prior to 4.15.1, upgrade to version 4.15.u1. For Tridium Niagara Enterprise Security versions prior to 4.10.11, upgrade to version 4.10u.11.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

CWE-117

Related Identifiers

CVE-2025-3942

Affected Products

Tridium Niagara Enterprise Security

Tridium Niagara Ax Framework

References · 6

• https://tridium.com/us/en/product-security · Vendor Advisory
• https://honeywell.com/us/en/product-security#security-notices · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3942 · Security Note
• https://osv.dev/vulnerability/CVE-2025-3942 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1925550194155819430 · Twitter Post
• https://twitter.com/CVEnew/status/1925539504422887854 · Twitter Post