by Kastro
Paper/Archive/CVE-2025-3938

CVE-2025-3938

Tridium Niagara Framework — Missing Cryptographic Step

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
35
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 26.3.263 × 205.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Missing Cryptographic Step vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.

Affected

ProductAffectedFixed inSource
Niagara Framework< 4.14.24.14.2CNA
Niagara Framework< 4.15.14.15.1CNA
Niagara Framework< 4.10.114.10.11CNA
Niagara Enterprise Security< 4.14.24.14.2CNA
Niagara Enterprise Security< 4.15.14.15.1CNA
Niagara Enterprise Security< 4.10.114.10.11CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Honeywell (CNA)6.8CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

advisoryhoneywell.com/us/en/product-security#security-noticesadvisorydocs.niagara-community.com/category/tech_bull