CVE-2025-3936

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-3936
Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.0 / Impact : 4.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://docs.niagara-community.com/category/tech_bull Permissions Required
https://www.honeywell.com/us/en/product-security#security-notices Vendor Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:tridium:niagara:4.10u10:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagara:4.14u1:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagara:4.15:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagara_enterprise_security:4.10u10:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagara_enterprise_security:4.14u1:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagara_enterprise_security:4.15:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
History

04 Jun 2025, 19:53

Type Values Removed Values Added
References () https://docs.niagara-community.com/category/tech_bull - () https://docs.niagara-community.com/category/tech_bull - Permissions Required
References () https://www.honeywell.com/us/en/product-security#security-notices - () https://www.honeywell.com/us/en/product-security#security-notices - Vendor Advisory
CPE cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagara:4.10u10:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagara_enterprise_security:4.15:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagara:4.15:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagara_enterprise_security:4.10u10:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagara:4.14u1:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagara_enterprise_security:4.14u1:*:*:*:*:*:*:*
First Time Microsoft
Tridium niagara
Tridium
Microsoft windows
Tridium niagara Enterprise Security

23 May 2025, 15:55

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de asignación incorrecta de permisos para recursos críticos en Tridium Niagara Framework para Windows, Tridium Niagara Enterprise Security para Windows permite explotar niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Niagara Framework: versiones anteriores a la 4.14.2, 4.15.1 y 4.10.11; Niagara Enterprise Security: versiones anteriores a la 4.14.2, 4.15.1 y 4.10.11. Tridium recomienda actualizar a las versiones 4.14.2u2, 4.15.u1 o 4.10u.11 de Niagara Framework y Enterprise Security.

22 May 2025, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-22 13:15

Updated : 2025-06-04 19:53

NVD link : CVE-2025-3936

Mitre link : CVE-2025-3936

CVE.ORG link : CVE-2025-3936

JSON object : View

Products Affected

tridium

  • niagara
  • niagara_enterprise_security

microsoft

  • windows
CWE
CWE-732

Incorrect Permission Assignment for Critical Resource