CVE-2025-3936 Incorrect Permission Assignment for Critical Resource

🗓️ 22 May 2025 12:20:42Reported by HoneywellType

Vulnerability in Tridium Niagara Framework allows incorrect permission assignment on Windows systems.

Reporter	Title	Published	Views	Family All 11
BDU FSTEC	The vulnerability of the device management platform for heating, ventilation, and air conditioning systems, lighting, and energy consumption within the Niagara Framework, along with the access control and security measures of Niagara Enterprise Security, arises from the improper assignment of permissions to critical resources. This allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.	29 Jul 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the device management platform for systems involving heating, ventilation, and air conditioning, lighting, and energy consumption within the Niagara Framework, along with the Niagara Enterprise Security tools for access control and security, stems from insufficient calculation of password hashes. This allows attackers to gain access to the device.	29 Jul 202500:00	–	bdu_fstec
Circl	CVE-2025-3936	7 Aug 202510:00	–	circl
CNNVD	Tridium Niagara Framework和Tridium Niagara Enterprise Security 安全漏洞	22 May 202500:00	–	cnnvd
CVE	CVE-2025-3936	22 May 202512:20	–	cve
EUVD	EUVD-2025-16159	3 Oct 202520:07	–	euvd
NVD	CVE-2025-3936	22 May 202513:15	–	nvd
Positive Technologies	PT-2025-22463 · Tridium +1 · Tridium Niagara Enterprise Security +2	22 May 202500:00	–	ptsecurity
Positive Technologies	PT-2025-22464 · Tridium · Tridium Niagara Enterprise Security +1	22 May 202500:00	–	ptsecurity
The Hacker News	Critical Flaws in Niagara Framework Threaten Smart Buildings and Industrial Systems Worldwide	28 Jul 202504:12	–	thn

[
  {
    "defaultStatus": "affected",
    "platforms": [
      "Windows"
    ],
    "product": "Niagara Framework",
    "vendor": "Tridium",
    "versions": [
      {
        "lessThan": "4.14.2",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.15.1",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.10.11",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "affected",
    "platforms": [
      "Windows"
    ],
    "product": "Niagara Enterprise Security",
    "vendor": "Tridium",
    "versions": [
      {
        "lessThan": "4.14.2",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.15.1",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.10.11",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
honeywell	www.honeywell.com/us/en/product-security
docs	www.docs.niagara-community.com/category/tech_bull

22 May 2025 12:50Current

CVSS 3.16.5

EPSS0.00172

CWE-732