CVE-2025-3943

Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Parameter Injection. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.

CVSS v3 4.1 MEDIUM

4.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://docs.niagara-community.com/category/tech_bull	Permissions Required
https://honeywell.com/us/en/product-security#security-notices	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:tridium:niagara:4.10u10:::::::*
	cpe:2.3:a:tridium:niagara:4.14u1:::::::*
	cpe:2.3:a:tridium:niagara:4.15:::::::*
	cpe:2.3:a:tridium:niagara_enterprise_security:4.10u10:::::::*
	cpe:2.3:a:tridium:niagara_enterprise_security:4.14u1:::::::*
	cpe:2.3:a:tridium:niagara_enterprise_security:4.15:::::::*

OR	cpe:2.3:o:blackberry:qnx:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

04 Jun 2025, 19:27

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-22 13:15

Updated : 2025-06-04 19:27

NVD link : CVE-2025-3943

Mitre link : CVE-2025-3943

CVE.ORG link : CVE-2025-3943

JSON object : View

Products Affected

blackberry

qnx

tridium

niagara_enterprise_security
niagara

microsoft

windows

linux

linux_kernel

CWE

CWE-598

Use of GET Request Method With Sensitive Query Strings

NVD-CWE-Other

{"id": "CVE-2025-3943", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@honeywell.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2025-05-22T13:15:57.257", "references": [{"url": "https://docs.niagara-community.com/category/tech_bull", "tags": ["Permissions Required"], "source": "psirt@honeywell.com"}, {"url": "https://honeywell.com/us/en/product-security#security-notices", "tags": ["Vendor Advisory"], "source": "psirt@honeywell.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@honeywell.com", "description": [{"lang": "en", "value": "CWE-598"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Parameter Injection. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."}, {"lang": "es", "value": "Vulnerabilidad en el uso del m\u00e9todo de solicitud GET con cadenas de consulta sensibles en Tridium Niagara Framework para Windows, Linux y QNX, Tridium Niagara Enterprise Security para Windows, Linux y QNX permite la inyecci\u00f3n de par\u00e1metros. Este problema afecta a Niagara Framework: versiones anteriores a la 4.14.2, 4.15.1 y 4.10.11; y Niagara Enterprise Security: versiones anteriores a la 4.14.2, 4.15.1 y 4.10.11. Tridium recomienda actualizar a las versiones 4.14.2u2, 4.15.u1 o 4.10u.11 de Niagara Framework y Enterprise Security."}], "lastModified": "2025-06-04T19:27:46.100", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tridium:niagara:4.10u10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0615B9FA-E837-4C21-8968-F3273718DF7D"}, {"criteria": "cpe:2.3:a:tridium:niagara:4.14u1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BEE26A6F-876E-450D-8A5F-EF4A3EF96A13"}, {"criteria": "cpe:2.3:a:tridium:niagara:4.15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00C6667A-9873-4A75-AB11-3427AA1E552D"}, {"criteria": "cpe:2.3:a:tridium:niagara_enterprise_security:4.10u10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E694C4DB-66F7-4753-81D8-9085B5E3A207"}, {"criteria": "cpe:2.3:a:tridium:niagara_enterprise_security:4.14u1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "506E75F5-D259-4BAC-9C1A-83C9AD54D608"}, {"criteria": "cpe:2.3:a:tridium:niagara_enterprise_security:4.15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6DF70636-5B89-4646-80F3-83C906B0EB3C"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:blackberry:qnx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3642981A-848E-4DEA-A904-A83B9ED4891D"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@honeywell.com"}