Tridium Niagara Incorrect Permission Assignment for Critical Resource (CVE-2025-3936)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505518);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/26");

  script_cve_id("CVE-2025-3936");

  script_name(english:"Tridium Niagara Incorrect Permission Assignment for Critical Resource (CVE-2025-3936)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Incorrect Permission Assignment for Critical Resource vulnerability
in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise
Security on Windows allows Exploiting Incorrectly Configured Access
Control Security Levels. This issue affects Niagara Framework:
before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise
Security: before 4.14.2, before 4.15.1, before 4.10.11.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.honeywell.com/content/dam/honeywellbt/en/documents/downloads/product-security/security-notification/hon-corp-niagara-software-vulnerabilities-2025-05-22-01.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?aa3ced70");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Niagara Framework and Niagara Enterprise Security version
4.14u2 or later. Updates for 4.10 and 4.15 will be released shortly.
Contact Tridium support at [email protected] for assistance.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-3936");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(732);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/05/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/25");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:tridium:niagara:4.10u10");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:tridium:niagara:4.14u1");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:tridium:niagara:4.15");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/assetBag");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/assetBag');

var asset = tenable_ot::assets::get(hasAssetBag:TRUE);

var vuln_cpes = {
    "cpe:/a:tridium:niagara:4.10u10" :
        {"versionStartIncluding" : "4.10u10", "versionEndIncluding" : "4.10u10", "family" : "Niagara"},
    "cpe:/a:tridium:niagara:4.14u1" :
        {"versionStartIncluding" : "4.14u1", "versionEndIncluding" : "4.14u1", "family" : "Niagara"},
    "cpe:/a:tridium:niagara:4.15" :
        {"versionStartIncluding" : "4.15", "versionEndIncluding" : "4.15", "family" : "Niagara"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);