IM
IronMonkey Threat Research

CVE-2025-3937 CRITICAL

Published: 2025-05-22 | Last Modified: 2025-06-04 | Status: Analyzed

Description

Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.

Additional Descriptions (1)

Vulnerabilidad de uso de hash de contraseña con esfuerzo computacional insuficiente en Tridium Niagara Framework para Windows, Linux y QNX, Tridium Niagara Enterprise Security para Windows, Linux y QNX permite el criptoanálisis. Este problema afecta a Niagara Framework: versiones anteriores a la 4.14.2, 4.15.1 y 4.10.11; Niagara Enterprise Security: versiones anteriores a la 4.14.2, 4.15.1 y 4.10.11. Tridium recomienda actualizar a las versiones 4.14.2u2, 4.15.u1 o 4.10u.11 de Niagara Framework y Enterprise Security.

CVSS Metrics

Base Score: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 5.9

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-916
[email protected] Primary
en CWE-916

Affected Products

Vendor Product Version Update Type
tridium niagara 4.10u10 <built-in method update of dict object at 0x7763b0b8c9c0> Application
tridium niagara 4.14u1 <built-in method update of dict object at 0x7763f057e180> Application
tridium niagara 4.15 <built-in method update of dict object at 0x7763bb11ea00> Application
tridium niagara_enterprise_security 4.10u10 <built-in method update of dict object at 0x7763b0b8c240> Application
tridium niagara_enterprise_security 4.14u1 <built-in method update of dict object at 0x7763f057dcc0> Application
tridium niagara_enterprise_security 4.15 <built-in method update of dict object at 0x7763f057ccc0> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:tridium:niagara:4.10u10:*:*:*:*:*:*:*
Yes cpe:2.3:a:tridium:niagara:4.14u1:*:*:*:*:*:*:*
Yes cpe:2.3:a:tridium:niagara:4.15:*:*:*:*:*:*:*
Yes cpe:2.3:a:tridium:niagara_enterprise_security:4.10u10:*:*:*:*:*:*:*
Yes cpe:2.3:a:tridium:niagara_enterprise_security:4.14u1:*:*:*:*:*:*:*
Yes cpe:2.3:a:tridium:niagara_enterprise_security:4.15:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:o:blackberry:qnx:-:*:*:*:*:*:*:*
No cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
No cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Notification
Message here