CVE-2025-3942
22.05.2025, 13:15
Improper Output Neutralization for Logs vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.Enginsight
| Vendor | Product | Version |
|---|---|---|
| tridium | niagara | 4.10u10:u10 |
| tridium | niagara | 4.14u1:u1 |
| tridium | niagara | 4.15 |
| tridium | niagara_enterprise_security | 4.10u10:u10 |
| tridium | niagara_enterprise_security | 4.14u1:u1 |
| tridium | niagara_enterprise_security | 4.15 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-117 - Improper Output Neutralization for LogsThe software does not neutralize or incorrectly neutralizes output that is written to logs.
- CWE-116 - Improper Encoding or Escaping of OutputThe software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.