PT-2025-22463 · Tridium +1 · Tridium Niagara Enterprise Security +2

🗓️ 22 May 2025 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbugs.ptsecurity.com👁 3 Views

Tridium Niagara Framework and Enterprise Security versions before updates are vulnerable to access issues.

Reporter	Title	Published	Views	Family All 12
BDU FSTEC	The vulnerability of the device management platform for heating, ventilation, and air conditioning systems, lighting, and energy consumption within the Niagara Framework, along with the access control and security measures of Niagara Enterprise Security, arises from the improper assignment of permissions to critical resources. This allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.	29 Jul 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the device management platform for systems involving heating, ventilation, and air conditioning, lighting, and energy consumption within the Niagara Framework, along with the Niagara Enterprise Security tools for access control and security, stems from insufficient calculation of password hashes. This allows attackers to gain access to the device.	29 Jul 202500:00	–	bdu_fstec
Circl	CVE-2025-3936	7 Aug 202510:00	–	circl
CNNVD	Tridium Niagara Framework和Tridium Niagara Enterprise Security 安全漏洞	22 May 202500:00	–	cnnvd
CVE	CVE-2025-3936	22 May 202512:20	–	cve
Cvelist	CVE-2025-3936 Incorrect Permission Assignment for Critical Resource	22 May 202512:20	–	cvelist
EUVD	EUVD-2025-16159	3 Oct 202520:07	–	euvd
NVD	CVE-2025-3936	22 May 202513:15	–	nvd
Positive Technologies	PT-2025-22464 · Tridium · Tridium Niagara Enterprise Security +1	22 May 202500:00	–	ptsecurity
Tenable Nessus	Tridium Niagara Incorrect Permission Assignment for Critical Resource (CVE-2025-3936)	25 Jun 202600:00	–	nessus

Source	Link
docs	www.docs.niagara-community.com/category/tech_bull
bdu	www.bdu.fstec.ru/vul/2025-09154
bdu	www.bdu.fstec.ru/vul/2025-09156
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-3936
honeywell	www.honeywell.com/us/en/product-security
nozominetworks	www.nozominetworks.com/blog/critical-vulnerabilities-found-in-tridium-niagara-framework
thehackernews	www.thehackernews.com/2025/07/critical-flaws-in-niagara-framework.html
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
t	www.t.me/cvenotify/124649
twitter	www.twitter.com/CVEnew/status/1925529700085997802

04 Jun 2025 00:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 210

CVSS 3.16.5 - 9.8

EPSS0.00366

SSVC