The vulnerability of the device management platform for heating, ventilation, and air conditioning systems, lighting, and energy consumption within the Niagara Framework, along with the access control and security measures of Niagara Enterprise Security, arises from the improper assignment of permissions to critical resources. This allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

🗓️ 29 Jul 2025 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 6 Views

Improper permission assignment in Niagara Framework exposes device management and security controls, risking data confidentiality.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2025-3936	7 Aug 202510:00	–	circl
CNNVD	Tridium Niagara Framework和Tridium Niagara Enterprise Security 安全漏洞	22 May 202500:00	–	cnnvd
CVE	CVE-2025-3936	22 May 202512:20	–	cve
Cvelist	CVE-2025-3936 Incorrect Permission Assignment for Critical Resource	22 May 202512:20	–	cvelist
EUVD	EUVD-2025-16159	3 Oct 202520:07	–	euvd
NVD	CVE-2025-3936	22 May 202513:15	–	nvd
Positive Technologies	PT-2025-22463 · Tridium +1 · Tridium Niagara Enterprise Security +2	22 May 202500:00	–	ptsecurity
Positive Technologies	PT-2025-22464 · Tridium · Tridium Niagara Enterprise Security +1	22 May 202500:00	–	ptsecurity
Tenable Nessus	Tridium Niagara Incorrect Permission Assignment for Critical Resource (CVE-2025-3936)	25 Jun 202600:00	–	nessus
The Hacker News	Critical Flaws in Niagara Framework Threaten Smart Buildings and Industrial Systems Worldwide	28 Jul 202504:12	–	thn

Vulners

Node

tridium niagara_frameworkRange<4.14.2

OR

tridium niagara_enterprise_securityRange<4.14.2

OR

tridium niagara_enterprise_securityRange<4.15.1

OR

tridium niagara_frameworkRange<4.15.1

OR

tridium niagara_frameworkRange<4.10.11

OR

tridium niagara_enterprise_securityRange<4.10.11

Source	Link
securitricks	www.securitricks.com/cve/CVE-2025-3936
honeywell	www.honeywell.com/us/en/product-security
thehackernews	www.thehackernews.com/2025/07/critical-flaws-in-niagara-framework.html
nozominetworks	www.nozominetworks.com/blog/critical-vulnerabilities-found-in-tridium-niagara-framework
web	www.web.nvd.nist.gov/view/vuln/detail

29 Jul 2025 00:00Current

8High risk

Vulners AI Score8

CVSS 39.8

CVSS 210

EPSS0.00366

niagara framework device management security controls access control permissions critical resources protected information data confidentiality integrity risk