CVE-2025-3943 Use of GET Request Method With sensitive Query Strings

🗓️ 22 May 2025 12:42:13Reported by HoneywellType

CVE-2025-3943 vulnerability allows parameter injection in Tridium Niagara Framework and Enterprise Security.

Reporter	Title	Published	Views	Family All 11
BDU FSTEC	The vulnerability of the device management platform for systems related to heating, ventilation, and air conditioning, lighting, and energy consumption within the Niagara Framework, as well as the Niagara Enterprise Security tools for access control and security, stems from the ability to disclose information through a query string, allowing attackers to compromise the confidentiality of protected information.	1 Aug 202500:00	–	bdu_fstec
Circl	CVE-2025-3943	22 May 202515:23	–	circl
CNNVD	Tridium Niagara Framework和Tridium Niagara Enterprise Security 安全漏洞	22 May 202500:00	–	cnnvd
CVE	CVE-2025-3943	22 May 202512:42	–	cve
EUVD	EUVD-2025-16142	3 Oct 202520:07	–	euvd
EUVD	EUVD-2025-16143	3 Oct 202520:07	–	euvd
NVD	CVE-2025-3943	22 May 202513:15	–	nvd
OSV	CVE-2025-3943	22 May 202513:15	–	osv
Positive Technologies	PT-2025-22470 · Tridium · Tridium Niagara Enterprise Security +1	22 May 202500:00	–	ptsecurity
The Hacker News	Critical Flaws in Niagara Framework Threaten Smart Buildings and Industrial Systems Worldwide	28 Jul 202504:12	–	thn

[
  {
    "defaultStatus": "affected",
    "platforms": [
      "Windows",
      "Linux",
      "QNX"
    ],
    "product": "Niagara Framework",
    "vendor": "Tridium",
    "versions": [
      {
        "lessThan": "4.14.2",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.15.1",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.10.11",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "affected",
    "platforms": [
      "Windows",
      "Linux",
      "QNX"
    ],
    "product": "Niagara Enterprise Security",
    "vendor": "Tridium",
    "versions": [
      {
        "lessThan": "4.14.2",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.15.1",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.10.11",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
honeywell	www.honeywell.com/us/en/product-security
docs	www.docs.niagara-community.com/category/tech_bull

22 May 2025 12:42Current

CVSS 3.14.1

EPSS0.07062

CWE-598