by Kastro
Paper/Archive/CVE-2025-3944

CVE-2025-3944

Tridium Niagara Framework — Incorrect Permission Assignment for Critical Resource

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 42.9.429 × 208.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows File Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.

Affected

ProductAffectedFixed inSource
Niagara Framework< 4.14.24.14.2CNA
Niagara Framework< 4.15.14.15.1CNA
Niagara Framework< 4.10.114.10.11CNA
Niagara Enterprise Security< 4.14.24.14.2CNA
Niagara Enterprise Security< 4.15.14.15.1CNA
Niagara Enterprise Security< 4.10.114.10.11CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Honeywell (CNA)7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisoryhoneywell.com/us/en/product-security#security-noticesadvisorydocs.niagara-community.com/category/tech_bull