Tridium Niagara Improper Use of Validation Framework (CVE-2025-3940)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505516);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/26");

  script_cve_id("CVE-2025-3940");

  script_name(english:"Tridium Niagara Improper Use of Validation Framework (CVE-2025-3940)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Improper Use of Validation Framework vulnerability in Tridium Niagara
Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security
on Windows, Linux, QNX allows Input Data Manipulation. This issue
affects Niagara Framework: before 4.14.2, before 4.15.1, before
4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1,
before 4.10.11.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.honeywell.com/content/dam/honeywellbt/en/documents/downloads/product-security/security-notification/hon-corp-niagara-software-vulnerabilities-2025-05-22-01.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?aa3ced70");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Niagara Framework and Niagara Enterprise Security version
4.14u2 or later. Updates for 4.10 and 4.15 will be released shortly.
Contact Tridium support at [email protected] for assistance.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-3940");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(1173);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/05/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/25");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:tridium:niagara:4.10u10");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:tridium:niagara:4.14u1");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:tridium:niagara:4.15");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/assetBag");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/assetBag');

var asset = tenable_ot::assets::get(hasAssetBag:TRUE);

var vuln_cpes = {
    "cpe:/a:tridium:niagara:4.10u10" :
        {"versionStartIncluding" : "4.10u10", "versionEndIncluding" : "4.10u10", "family" : "Niagara"},
    "cpe:/a:tridium:niagara:4.14u1" :
        {"versionStartIncluding" : "4.14u1", "versionEndIncluding" : "4.14u1", "family" : "Niagara"},
    "cpe:/a:tridium:niagara:4.15" :
        {"versionStartIncluding" : "4.15", "versionEndIncluding" : "4.15", "family" : "Niagara"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);