Tridium Niagara Improper Encoding or Escaping of Output (CVE-2025-3942)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505523);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/26");

  script_cve_id("CVE-2025-3942");

  script_name(english:"Tridium Niagara Improper Encoding or Escaping of Output (CVE-2025-3942)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Improper Output Neutralization for Logs vulnerability in Tridium
Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise
Security on Windows, Linux, QNX allows Input Data Manipulation. This
issue affects Niagara Framework: before 4.14.2, before 4.15.1, before
4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1,
before 4.10.11.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.honeywell.com/content/dam/honeywellbt/en/documents/downloads/product-security/security-notification/hon-corp-niagara-software-vulnerabilities-2025-05-22-01.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?aa3ced70");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Niagara Framework and Niagara Enterprise Security version
4.14u2 or later. Updates for 4.10 and 4.15 will be released shortly.
Contact Tridium support at [email protected] for assistance.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-3942");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(116);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/05/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/25");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:tridium:niagara:4.10u10");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:tridium:niagara:4.14u1");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:tridium:niagara:4.15");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/assetBag");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/assetBag');

var asset = tenable_ot::assets::get(hasAssetBag:TRUE);

var vuln_cpes = {
    "cpe:/a:tridium:niagara:4.10u10" :
        {"versionStartIncluding" : "4.10u10", "versionEndIncluding" : "4.10u10", "family" : "Niagara"},
    "cpe:/a:tridium:niagara:4.14u1" :
        {"versionStartIncluding" : "4.14u1", "versionEndIncluding" : "4.14u1", "family" : "Niagara"},
    "cpe:/a:tridium:niagara:4.15" :
        {"versionStartIncluding" : "4.15", "versionEndIncluding" : "4.15", "family" : "Niagara"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);