Tridium Niagara Use of GET Request Method With Sensitive Query Strings (CVE-2025-3943)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505525);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/26");

  script_cve_id("CVE-2025-3943");

  script_name(english:"Tridium Niagara Use of GET Request Method With Sensitive Query Strings (CVE-2025-3943)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Use of GET Request Method With Sensitive Query Strings vulnerability
in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara
Enterprise Security on Windows, Linux, QNX allows Parameter
Injection. This issue affects Niagara Framework: before 4.14.2,
before 4.15.1, before 4.10.11; Niagara Enterprise Security: before
4.14.2, before 4.15.1, before 4.10.11.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.honeywell.com/content/dam/honeywellbt/en/documents/downloads/product-security/security-notification/hon-corp-niagara-software-vulnerabilities-2025-05-22-01.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?aa3ced70");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Niagara Framework and Niagara Enterprise Security version
4.14u2 or later. Updates for 4.10 and 4.15 will be released shortly.
Contact Tridium support at [email protected] for assistance.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-3943");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(598);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/05/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/25");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:tridium:niagara:4.10u10");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:tridium:niagara:4.14u1");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:tridium:niagara:4.15");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/assetBag");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/assetBag');

var asset = tenable_ot::assets::get(hasAssetBag:TRUE);

var vuln_cpes = {
    "cpe:/a:tridium:niagara:4.10u10" :
        {"versionStartIncluding" : "4.10u10", "versionEndIncluding" : "4.10u10", "family" : "Niagara"},
    "cpe:/a:tridium:niagara:4.14u1" :
        {"versionStartIncluding" : "4.14u1", "versionEndIncluding" : "4.14u1", "family" : "Niagara"},
    "cpe:/a:tridium:niagara:4.15" :
        {"versionStartIncluding" : "4.15", "versionEndIncluding" : "4.15", "family" : "Niagara"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);