Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    51 vulnerabilities by tridium

    CVE-2025-3945 (GCVE-0-2025-3945)

    Vulnerability from cvelistv5 – Published: 2025-05-22 12:47 – Updated: 2025-05-22 13:17
    VLAI
    Title
    Improper Neutralization of Argument Delimiters in a Command (‘Argument Injection’)
    Summary
    Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows Command Delimiters. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
    Severity
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Tridium Niagara Framework Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Tridium Niagara Enterprise Security Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Date Public
    2025-05-08 16:59
    Credits
    Andrea Palanca and team at Nozomi Network
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3945",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T13:17:20.455610Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T13:17:49.912Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "QNX"
          ],
          "product": "Niagara Framework",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "platforms": [
            "QNX"
          ],
          "product": "Niagara Enterprise Security",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrea Palanca and team at Nozomi Network"
        }
      ],
      "datePublic": "2025-05-08T16:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027) vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows Command Delimiters. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u0026nbsp;Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
            }
          ],
          "value": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027) vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows Command Delimiters. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-15",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-15 Command Delimiters"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-22T12:47:00.903Z",
        "orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
        "shortName": "Honeywell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://honeywell.com/us/en/product-security#security-notices"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.niagara-community.com/category/tech_bull"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper Neutralization of Argument Delimiters in a Command (\u2018Argument Injection\u2019)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
    "assignerShortName": "Honeywell",
    "cveId": "CVE-2025-3945",
    "datePublished": "2025-05-22T12:47:00.903Z",
    "dateReserved": "2025-04-25T15:21:20.955Z",
    "dateUpdated": "2025-05-22T13:17:49.912Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-3944 (GCVE-0-2025-3944)

    Vulnerability from cvelistv5 – Published: 2025-05-22 12:44 – Updated: 2025-05-22 13:17
    VLAI
    Title
    Incorrect Permission Assignment for Critical Resource
    Summary
    Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows File Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
    Severity
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-732 - Incorrect Permission Assignment for Critical Resource
    Assigner
    References
    Impacted products
    Vendor Product Version
    Tridium Niagara Framework Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Tridium Niagara Enterprise Security Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Date Public
    2025-05-08 16:59
    Credits
    Andrea Palanca and team at Nozomi Network
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3944",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T13:17:31.112109Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T13:17:37.301Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "QNX"
          ],
          "product": "Niagara Framework",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "platforms": [
            "QNX"
          ],
          "product": "Niagara Enterprise Security",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrea Palanca and team at Nozomi Network"
        }
      ],
      "datePublic": "2025-05-08T16:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows File Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u0026nbsp;Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
            }
          ],
          "value": "Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows File Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-165",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-165 File Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-22T12:45:05.762Z",
        "orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
        "shortName": "Honeywell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.honeywell.com/us/en/product-security#security-notices"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.niagara-community.com/category/tech_bull"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Incorrect Permission Assignment for Critical Resource",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
    "assignerShortName": "Honeywell",
    "cveId": "CVE-2025-3944",
    "datePublished": "2025-05-22T12:44:55.511Z",
    "dateReserved": "2025-04-25T15:21:20.179Z",
    "dateUpdated": "2025-05-22T13:17:37.301Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-3943 (GCVE-0-2025-3943)

    Vulnerability from cvelistv5 – Published: 2025-05-22 12:42 – Updated: 2025-05-22 13:19
    VLAI
    Title
    Use of GET Request Method With sensitive Query Strings
    Summary
    Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Parameter Injection. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
    Severity
    4.1 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-598 - Use of GET Request Method With Sensitive Query Strings
    Assigner
    References
    Impacted products
    Vendor Product Version
    Tridium Niagara Framework Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Tridium Niagara Enterprise Security Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Date Public
    2025-05-08 16:59
    Credits
    Andrea Palanca and team at Nozomi Network
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3943",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T13:19:00.551594Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T13:19:08.477Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows",
            "Linux",
            "QNX"
          ],
          "product": "Niagara Framework",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows",
            "Linux",
            "QNX"
          ],
          "product": "Niagara Enterprise Security",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrea Palanca and team at Nozomi Network"
        }
      ],
      "datePublic": "2025-05-08T16:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Parameter Injection. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u0026nbsp;Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Parameter Injection. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-137",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-137 Parameter Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-598",
              "description": "CWE-598 Use of GET Request Method With Sensitive Query Strings",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-22T12:42:13.893Z",
        "orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
        "shortName": "Honeywell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://honeywell.com/us/en/product-security#security-notices"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.niagara-community.com/category/tech_bull"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Use of GET Request Method With sensitive Query Strings",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
    "assignerShortName": "Honeywell",
    "cveId": "CVE-2025-3943",
    "datePublished": "2025-05-22T12:42:13.893Z",
    "dateReserved": "2025-04-25T15:21:19.481Z",
    "dateUpdated": "2025-05-22T13:19:08.477Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-3942 (GCVE-0-2025-3942)

    Vulnerability from cvelistv5 – Published: 2025-05-22 12:40 – Updated: 2025-05-22 13:36
    VLAI
    Title
    Improper Output Neutralization for Logs
    Summary
    Improper Output Neutralization for Logs vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-117 - Improper Output Neutralization for Logs
    Assigner
    References
    Impacted products
    Vendor Product Version
    Tridium Niagara Framework Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Tridium Niagara Enterprise Security Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Date Public
    2025-05-08 16:59
    Credits
    Andrea Palanca and team at Nozomi Networks
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3942",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T13:36:08.958420Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T13:36:18.427Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows",
            "Linux",
            "QNX"
          ],
          "product": "Niagara Framework",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows",
            "Linux",
            "QNX"
          ],
          "product": "Niagara Enterprise Security",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrea Palanca and team at Nozomi Networks"
        }
      ],
      "datePublic": "2025-05-08T16:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Output Neutralization for Logs vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u0026nbsp;Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
            }
          ],
          "value": "Improper Output Neutralization for Logs vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-153 Input Data Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-117",
              "description": "CWE-117 Improper Output Neutralization for Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-22T12:40:12.581Z",
        "orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
        "shortName": "Honeywell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.tridium.com/us/en/product-security"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.honeywell.com/us/en/product-security#security-notices"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper Output Neutralization for Logs",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
    "assignerShortName": "Honeywell",
    "cveId": "CVE-2025-3942",
    "datePublished": "2025-05-22T12:40:12.581Z",
    "dateReserved": "2025-04-25T15:21:18.791Z",
    "dateUpdated": "2025-05-22T13:36:18.427Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-3941 (GCVE-0-2025-3941)

    Vulnerability from cvelistv5 – Published: 2025-05-22 12:38 – Updated: 2025-05-22 13:52
    VLAI
    Title
    Improper Handling of Windows: DATA Alternate Data Stream
    Summary
    Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
    Severity
    5.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-69 - Improper Handling of Windows ::DATA Alternate Data Stream
    Assigner
    References
    Impacted products
    Vendor Product Version
    Tridium Niagara Framework Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Tridium Niagara Enterprise Security Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Date Public
    2025-05-08 16:59
    Credits
    Andrea Palanca and team at Nozomi Networks
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3941",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T13:47:50.253374Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T13:52:36.314Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows"
          ],
          "product": "Niagara Framework",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows"
          ],
          "product": "Niagara Enterprise Security",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrea Palanca and team at Nozomi Networks"
        }
      ],
      "datePublic": "2025-05-08T16:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
            }
          ],
          "value": "Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-153 Input Data Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-69",
              "description": "CWE-69 Improper Handling of Windows ::DATA Alternate Data Stream",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-22T12:48:36.986Z",
        "orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
        "shortName": "Honeywell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.honeywell.com/us/en/product-security#security-notices"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.niagara-community.com/category/tech_bull"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper Handling of Windows: DATA Alternate Data Stream",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
    "assignerShortName": "Honeywell",
    "cveId": "CVE-2025-3941",
    "datePublished": "2025-05-22T12:38:15.750Z",
    "dateReserved": "2025-04-25T15:21:18.048Z",
    "dateUpdated": "2025-05-22T13:52:36.314Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-3940 (GCVE-0-2025-3940)

    Vulnerability from cvelistv5 – Published: 2025-05-22 12:35 – Updated: 2025-05-22 14:00
    VLAI
    Title
    Improper Use of Validation Framework
    Summary
    Improper Use of Validation Framework vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
    Severity
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-1173 - Improper Use of Validation Framework
    Assigner
    References
    Impacted products
    Vendor Product Version
    Tridium Niagara Framework Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Tridium Niagara Enterprise Security Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Date Public
    2025-05-08 16:59
    Credits
    Andrea Palanca and team at Nozomi Networks
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3940",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T13:56:59.299523Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T14:00:58.907Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows",
            "Linux",
            "QNX"
          ],
          "product": "Niagara Framework",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows",
            "Linux",
            "QNX"
          ],
          "product": "Niagara Enterprise Security",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrea Palanca and team at Nozomi Networks"
        }
      ],
      "datePublic": "2025-05-08T16:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Use of Validation Framework vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u0026nbsp;Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
            }
          ],
          "value": "Improper Use of Validation Framework vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-153 Input Data Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1173",
              "description": "CWE-1173 Improper Use of Validation Framework",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-22T12:48:54.098Z",
        "orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
        "shortName": "Honeywell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://honeywell.com/us/en/product-security#security-notices"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.niagara-community.com/category/tech_bull"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper Use of Validation Framework",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
    "assignerShortName": "Honeywell",
    "cveId": "CVE-2025-3940",
    "datePublished": "2025-05-22T12:35:14.174Z",
    "dateReserved": "2025-04-25T15:21:17.262Z",
    "dateUpdated": "2025-05-22T14:00:58.907Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-3939 (GCVE-0-2025-3939)

    Vulnerability from cvelistv5 – Published: 2025-05-22 12:33 – Updated: 2025-05-22 14:02
    VLAI
    Title
    Observable Response Discrepancy
    Summary
    Observable Response Discrepancy vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
    Severity
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-204 - Observable Response Discrepancy
    Assigner
    References
    Impacted products
    Vendor Product Version
    Tridium Niagara Framework Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Tridium Niagara Enterprise Security Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Date Public
    2025-05-08 16:59
    Credits
    Andrea Palanca and team at Nozomi Networks
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3939",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T14:01:37.287802Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T14:02:22.839Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows",
            "Linux",
            "QNX"
          ],
          "product": "Niagara Framework",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows",
            "Linux",
            "QNX"
          ],
          "product": "Niagara Enterprise Security",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrea Palanca and team at Nozomi Networks"
        }
      ],
      "datePublic": "2025-05-08T16:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Observable Response Discrepancy vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
            }
          ],
          "value": "Observable Response Discrepancy vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-97",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-97 Cryptanalysis"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-204",
              "description": "CWE-204 Observable Response Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-22T12:49:10.315Z",
        "orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
        "shortName": "Honeywell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://honeywell.com/us/en/product-security#security-notices"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.niagara-community.com/category/tech_bull"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Observable Response Discrepancy",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
    "assignerShortName": "Honeywell",
    "cveId": "CVE-2025-3939",
    "datePublished": "2025-05-22T12:33:48.250Z",
    "dateReserved": "2025-04-25T15:21:16.473Z",
    "dateUpdated": "2025-05-22T14:02:22.839Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-3938 (GCVE-0-2025-3938)

    Vulnerability from cvelistv5 – Published: 2025-05-22 12:32 – Updated: 2025-05-22 14:10
    VLAI
    Title
    Missing Cryptographic Step
    Summary
    Missing Cryptographic Step vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
    Severity
    6.8 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-325 - Missing Cryptographic Step
    Assigner
    References
    Impacted products
    Vendor Product Version
    Tridium Niagara Framework Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Tridium Niagara Enterprise Security Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Date Public
    2025-05-08 16:59
    Credits
    Andrea Palanca and team at Nozomi Networks
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3938",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T14:03:16.201132Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T14:10:21.621Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows",
            "Linux",
            "QNX"
          ],
          "product": "Niagara Framework",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows",
            "Linux",
            "QNX"
          ],
          "product": "Niagara Enterprise Security",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrea Palanca and team at Nozomi Networks"
        }
      ],
      "datePublic": "2025-05-08T16:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Cryptographic Step vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u0026nbsp;Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.\u003cbr\u003e"
            }
          ],
          "value": "Missing Cryptographic Step vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-97",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-97 Cryptanalysis"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-325",
              "description": "CWE-325 Missing Cryptographic Step",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-22T12:49:32.299Z",
        "orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
        "shortName": "Honeywell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.honeywell.com/us/en/product-security#security-notices"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.niagara-community.com/category/tech_bull"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Missing Cryptographic Step",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
    "assignerShortName": "Honeywell",
    "cveId": "CVE-2025-3938",
    "datePublished": "2025-05-22T12:32:01.669Z",
    "dateReserved": "2025-04-25T15:21:15.598Z",
    "dateUpdated": "2025-05-22T14:10:21.621Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-3937 (GCVE-0-2025-3937)

    Vulnerability from cvelistv5 – Published: 2025-05-22 12:23 – Updated: 2025-05-22 14:43
    VLAI
    Title
    Use of Password Hash with Insufficient Computational Effort
    Summary
    Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
    Severity
    7.7 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-916 - Use of Password Hash With Insufficient Computational Effort
    Assigner
    References
    Impacted products
    Vendor Product Version
    Tridium Niagara Framework Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Tridium Niagara Enterprise Security Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Date Public
    2025-05-08 16:59
    Credits
    Andrea Palanca and team at Nozomi Networks
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3937",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T14:29:29.244650Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T14:43:13.538Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows",
            "Linux",
            "QNX"
          ],
          "product": "Niagara Framework",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows",
            "Linux",
            "QNX"
          ],
          "product": "Niagara Enterprise Security",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrea Palanca and team at Nozomi Networks"
        }
      ],
      "datePublic": "2025-05-08T16:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u0026nbsp;Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
            }
          ],
          "value": "Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-97",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-97 Cryptanalysis"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-916",
              "description": "CWE-916 Use of Password Hash With Insufficient Computational Effort",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-22T12:50:14.135Z",
        "orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
        "shortName": "Honeywell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.niagara-community.com/category/tech_bull"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.honeywell.com/us/en/product-security#security-notices"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Use of Password Hash with Insufficient Computational Effort",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
    "assignerShortName": "Honeywell",
    "cveId": "CVE-2025-3937",
    "datePublished": "2025-05-22T12:23:42.058Z",
    "dateReserved": "2025-04-25T15:21:14.598Z",
    "dateUpdated": "2025-05-22T14:43:13.538Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-3936 (GCVE-0-2025-3936)

    Vulnerability from cvelistv5 – Published: 2025-05-22 12:20 – Updated: 2025-05-22 17:29
    VLAI
    Title
    Incorrect Permission Assignment for Critical Resource
    Summary
    Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-732 - Incorrect Permission Assignment for Critical Resource
    Assigner
    References
    Impacted products
    Vendor Product Version
    Tridium Niagara Framework Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Tridium Niagara Enterprise Security Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Date Public
    2025-05-08 16:59
    Credits
    Andrea Palanca and team at Nozomi Networks
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3936",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T17:19:05.444995Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T17:29:38.532Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows"
          ],
          "product": "Niagara Framework",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows"
          ],
          "product": "Niagara Enterprise Security",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrea Palanca and team at Nozomi Networks"
        }
      ],
      "datePublic": "2025-05-08T16:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u0026nbsp;Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.\u003cbr\u003e"
            }
          ],
          "value": "Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-22T12:50:32.521Z",
        "orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
        "shortName": "Honeywell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.niagara-community.com/category/tech_bull"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.honeywell.com/us/en/product-security#security-notices"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Incorrect Permission Assignment for Critical Resource",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
    "assignerShortName": "Honeywell",
    "cveId": "CVE-2025-3936",
    "datePublished": "2025-05-22T12:20:42.337Z",
    "dateReserved": "2025-04-25T15:21:09.014Z",
    "dateUpdated": "2025-05-22T17:29:38.532Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-3945 (GCVE-0-2025-3945)

    Vulnerability from nvd – Published: 2025-05-22 12:47 – Updated: 2025-05-22 13:17
    VLAI
    Title
    Improper Neutralization of Argument Delimiters in a Command (‘Argument Injection’)
    Summary
    Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows Command Delimiters. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
    Severity
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Tridium Niagara Framework Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Tridium Niagara Enterprise Security Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Date Public
    2025-05-08 16:59
    Credits
    Andrea Palanca and team at Nozomi Network
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3945",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T13:17:20.455610Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T13:17:49.912Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "QNX"
          ],
          "product": "Niagara Framework",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "platforms": [
            "QNX"
          ],
          "product": "Niagara Enterprise Security",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrea Palanca and team at Nozomi Network"
        }
      ],
      "datePublic": "2025-05-08T16:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027) vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows Command Delimiters. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u0026nbsp;Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
            }
          ],
          "value": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027) vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows Command Delimiters. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-15",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-15 Command Delimiters"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-22T12:47:00.903Z",
        "orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
        "shortName": "Honeywell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://honeywell.com/us/en/product-security#security-notices"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.niagara-community.com/category/tech_bull"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper Neutralization of Argument Delimiters in a Command (\u2018Argument Injection\u2019)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
    "assignerShortName": "Honeywell",
    "cveId": "CVE-2025-3945",
    "datePublished": "2025-05-22T12:47:00.903Z",
    "dateReserved": "2025-04-25T15:21:20.955Z",
    "dateUpdated": "2025-05-22T13:17:49.912Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-3944 (GCVE-0-2025-3944)

    Vulnerability from nvd – Published: 2025-05-22 12:44 – Updated: 2025-05-22 13:17
    VLAI
    Title
    Incorrect Permission Assignment for Critical Resource
    Summary
    Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows File Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
    Severity
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-732 - Incorrect Permission Assignment for Critical Resource
    Assigner
    References
    Impacted products
    Vendor Product Version
    Tridium Niagara Framework Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Tridium Niagara Enterprise Security Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Date Public
    2025-05-08 16:59
    Credits
    Andrea Palanca and team at Nozomi Network
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3944",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T13:17:31.112109Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T13:17:37.301Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "QNX"
          ],
          "product": "Niagara Framework",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "platforms": [
            "QNX"
          ],
          "product": "Niagara Enterprise Security",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrea Palanca and team at Nozomi Network"
        }
      ],
      "datePublic": "2025-05-08T16:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows File Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u0026nbsp;Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
            }
          ],
          "value": "Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows File Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-165",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-165 File Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-22T12:45:05.762Z",
        "orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
        "shortName": "Honeywell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.honeywell.com/us/en/product-security#security-notices"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.niagara-community.com/category/tech_bull"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Incorrect Permission Assignment for Critical Resource",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
    "assignerShortName": "Honeywell",
    "cveId": "CVE-2025-3944",
    "datePublished": "2025-05-22T12:44:55.511Z",
    "dateReserved": "2025-04-25T15:21:20.179Z",
    "dateUpdated": "2025-05-22T13:17:37.301Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-3943 (GCVE-0-2025-3943)

    Vulnerability from nvd – Published: 2025-05-22 12:42 – Updated: 2025-05-22 13:19
    VLAI
    Title
    Use of GET Request Method With sensitive Query Strings
    Summary
    Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Parameter Injection. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
    Severity
    4.1 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-598 - Use of GET Request Method With Sensitive Query Strings
    Assigner
    References
    Impacted products
    Vendor Product Version
    Tridium Niagara Framework Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Tridium Niagara Enterprise Security Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Date Public
    2025-05-08 16:59
    Credits
    Andrea Palanca and team at Nozomi Network
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3943",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T13:19:00.551594Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T13:19:08.477Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows",
            "Linux",
            "QNX"
          ],
          "product": "Niagara Framework",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows",
            "Linux",
            "QNX"
          ],
          "product": "Niagara Enterprise Security",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrea Palanca and team at Nozomi Network"
        }
      ],
      "datePublic": "2025-05-08T16:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Parameter Injection. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u0026nbsp;Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Parameter Injection. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-137",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-137 Parameter Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-598",
              "description": "CWE-598 Use of GET Request Method With Sensitive Query Strings",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-22T12:42:13.893Z",
        "orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
        "shortName": "Honeywell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://honeywell.com/us/en/product-security#security-notices"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.niagara-community.com/category/tech_bull"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Use of GET Request Method With sensitive Query Strings",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
    "assignerShortName": "Honeywell",
    "cveId": "CVE-2025-3943",
    "datePublished": "2025-05-22T12:42:13.893Z",
    "dateReserved": "2025-04-25T15:21:19.481Z",
    "dateUpdated": "2025-05-22T13:19:08.477Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-3942 (GCVE-0-2025-3942)

    Vulnerability from nvd – Published: 2025-05-22 12:40 – Updated: 2025-05-22 13:36
    VLAI
    Title
    Improper Output Neutralization for Logs
    Summary
    Improper Output Neutralization for Logs vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-117 - Improper Output Neutralization for Logs
    Assigner
    References
    Impacted products
    Vendor Product Version
    Tridium Niagara Framework Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Tridium Niagara Enterprise Security Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Date Public
    2025-05-08 16:59
    Credits
    Andrea Palanca and team at Nozomi Networks
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3942",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T13:36:08.958420Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T13:36:18.427Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows",
            "Linux",
            "QNX"
          ],
          "product": "Niagara Framework",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows",
            "Linux",
            "QNX"
          ],
          "product": "Niagara Enterprise Security",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrea Palanca and team at Nozomi Networks"
        }
      ],
      "datePublic": "2025-05-08T16:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Output Neutralization for Logs vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u0026nbsp;Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
            }
          ],
          "value": "Improper Output Neutralization for Logs vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-153 Input Data Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-117",
              "description": "CWE-117 Improper Output Neutralization for Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-22T12:40:12.581Z",
        "orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
        "shortName": "Honeywell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.tridium.com/us/en/product-security"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.honeywell.com/us/en/product-security#security-notices"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper Output Neutralization for Logs",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
    "assignerShortName": "Honeywell",
    "cveId": "CVE-2025-3942",
    "datePublished": "2025-05-22T12:40:12.581Z",
    "dateReserved": "2025-04-25T15:21:18.791Z",
    "dateUpdated": "2025-05-22T13:36:18.427Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-3941 (GCVE-0-2025-3941)

    Vulnerability from nvd – Published: 2025-05-22 12:38 – Updated: 2025-05-22 13:52
    VLAI
    Title
    Improper Handling of Windows: DATA Alternate Data Stream
    Summary
    Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
    Severity
    5.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-69 - Improper Handling of Windows ::DATA Alternate Data Stream
    Assigner
    References
    Impacted products
    Vendor Product Version
    Tridium Niagara Framework Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Tridium Niagara Enterprise Security Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Date Public
    2025-05-08 16:59
    Credits
    Andrea Palanca and team at Nozomi Networks
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3941",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T13:47:50.253374Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T13:52:36.314Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows"
          ],
          "product": "Niagara Framework",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows"
          ],
          "product": "Niagara Enterprise Security",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrea Palanca and team at Nozomi Networks"
        }
      ],
      "datePublic": "2025-05-08T16:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
            }
          ],
          "value": "Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-153 Input Data Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-69",
              "description": "CWE-69 Improper Handling of Windows ::DATA Alternate Data Stream",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-22T12:48:36.986Z",
        "orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
        "shortName": "Honeywell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.honeywell.com/us/en/product-security#security-notices"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.niagara-community.com/category/tech_bull"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper Handling of Windows: DATA Alternate Data Stream",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
    "assignerShortName": "Honeywell",
    "cveId": "CVE-2025-3941",
    "datePublished": "2025-05-22T12:38:15.750Z",
    "dateReserved": "2025-04-25T15:21:18.048Z",
    "dateUpdated": "2025-05-22T13:52:36.314Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-3940 (GCVE-0-2025-3940)

    Vulnerability from nvd – Published: 2025-05-22 12:35 – Updated: 2025-05-22 14:00
    VLAI
    Title
    Improper Use of Validation Framework
    Summary
    Improper Use of Validation Framework vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
    Severity
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-1173 - Improper Use of Validation Framework
    Assigner
    References
    Impacted products
    Vendor Product Version
    Tridium Niagara Framework Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Tridium Niagara Enterprise Security Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Date Public
    2025-05-08 16:59
    Credits
    Andrea Palanca and team at Nozomi Networks
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3940",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T13:56:59.299523Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T14:00:58.907Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows",
            "Linux",
            "QNX"
          ],
          "product": "Niagara Framework",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows",
            "Linux",
            "QNX"
          ],
          "product": "Niagara Enterprise Security",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrea Palanca and team at Nozomi Networks"
        }
      ],
      "datePublic": "2025-05-08T16:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Use of Validation Framework vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u0026nbsp;Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
            }
          ],
          "value": "Improper Use of Validation Framework vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-153 Input Data Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1173",
              "description": "CWE-1173 Improper Use of Validation Framework",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-22T12:48:54.098Z",
        "orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
        "shortName": "Honeywell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://honeywell.com/us/en/product-security#security-notices"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.niagara-community.com/category/tech_bull"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper Use of Validation Framework",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
    "assignerShortName": "Honeywell",
    "cveId": "CVE-2025-3940",
    "datePublished": "2025-05-22T12:35:14.174Z",
    "dateReserved": "2025-04-25T15:21:17.262Z",
    "dateUpdated": "2025-05-22T14:00:58.907Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-3939 (GCVE-0-2025-3939)

    Vulnerability from nvd – Published: 2025-05-22 12:33 – Updated: 2025-05-22 14:02
    VLAI
    Title
    Observable Response Discrepancy
    Summary
    Observable Response Discrepancy vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
    Severity
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-204 - Observable Response Discrepancy
    Assigner
    References
    Impacted products
    Vendor Product Version
    Tridium Niagara Framework Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Tridium Niagara Enterprise Security Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Date Public
    2025-05-08 16:59
    Credits
    Andrea Palanca and team at Nozomi Networks
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3939",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T14:01:37.287802Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T14:02:22.839Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows",
            "Linux",
            "QNX"
          ],
          "product": "Niagara Framework",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows",
            "Linux",
            "QNX"
          ],
          "product": "Niagara Enterprise Security",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrea Palanca and team at Nozomi Networks"
        }
      ],
      "datePublic": "2025-05-08T16:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Observable Response Discrepancy vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
            }
          ],
          "value": "Observable Response Discrepancy vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-97",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-97 Cryptanalysis"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-204",
              "description": "CWE-204 Observable Response Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-22T12:49:10.315Z",
        "orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
        "shortName": "Honeywell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://honeywell.com/us/en/product-security#security-notices"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.niagara-community.com/category/tech_bull"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Observable Response Discrepancy",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
    "assignerShortName": "Honeywell",
    "cveId": "CVE-2025-3939",
    "datePublished": "2025-05-22T12:33:48.250Z",
    "dateReserved": "2025-04-25T15:21:16.473Z",
    "dateUpdated": "2025-05-22T14:02:22.839Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-3938 (GCVE-0-2025-3938)

    Vulnerability from nvd – Published: 2025-05-22 12:32 – Updated: 2025-05-22 14:10
    VLAI
    Title
    Missing Cryptographic Step
    Summary
    Missing Cryptographic Step vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
    Severity
    6.8 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-325 - Missing Cryptographic Step
    Assigner
    References
    Impacted products
    Vendor Product Version
    Tridium Niagara Framework Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Tridium Niagara Enterprise Security Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Date Public
    2025-05-08 16:59
    Credits
    Andrea Palanca and team at Nozomi Networks
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3938",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T14:03:16.201132Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T14:10:21.621Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows",
            "Linux",
            "QNX"
          ],
          "product": "Niagara Framework",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows",
            "Linux",
            "QNX"
          ],
          "product": "Niagara Enterprise Security",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrea Palanca and team at Nozomi Networks"
        }
      ],
      "datePublic": "2025-05-08T16:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Cryptographic Step vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u0026nbsp;Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.\u003cbr\u003e"
            }
          ],
          "value": "Missing Cryptographic Step vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-97",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-97 Cryptanalysis"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-325",
              "description": "CWE-325 Missing Cryptographic Step",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-22T12:49:32.299Z",
        "orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
        "shortName": "Honeywell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.honeywell.com/us/en/product-security#security-notices"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.niagara-community.com/category/tech_bull"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Missing Cryptographic Step",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
    "assignerShortName": "Honeywell",
    "cveId": "CVE-2025-3938",
    "datePublished": "2025-05-22T12:32:01.669Z",
    "dateReserved": "2025-04-25T15:21:15.598Z",
    "dateUpdated": "2025-05-22T14:10:21.621Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-3937 (GCVE-0-2025-3937)

    Vulnerability from nvd – Published: 2025-05-22 12:23 – Updated: 2025-05-22 14:43
    VLAI
    Title
    Use of Password Hash with Insufficient Computational Effort
    Summary
    Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
    Severity
    7.7 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-916 - Use of Password Hash With Insufficient Computational Effort
    Assigner
    References
    Impacted products
    Vendor Product Version
    Tridium Niagara Framework Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Tridium Niagara Enterprise Security Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Date Public
    2025-05-08 16:59
    Credits
    Andrea Palanca and team at Nozomi Networks
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3937",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T14:29:29.244650Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T14:43:13.538Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows",
            "Linux",
            "QNX"
          ],
          "product": "Niagara Framework",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows",
            "Linux",
            "QNX"
          ],
          "product": "Niagara Enterprise Security",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrea Palanca and team at Nozomi Networks"
        }
      ],
      "datePublic": "2025-05-08T16:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u0026nbsp;Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
            }
          ],
          "value": "Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-97",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-97 Cryptanalysis"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-916",
              "description": "CWE-916 Use of Password Hash With Insufficient Computational Effort",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-22T12:50:14.135Z",
        "orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
        "shortName": "Honeywell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.niagara-community.com/category/tech_bull"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.honeywell.com/us/en/product-security#security-notices"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Use of Password Hash with Insufficient Computational Effort",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
    "assignerShortName": "Honeywell",
    "cveId": "CVE-2025-3937",
    "datePublished": "2025-05-22T12:23:42.058Z",
    "dateReserved": "2025-04-25T15:21:14.598Z",
    "dateUpdated": "2025-05-22T14:43:13.538Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-3936 (GCVE-0-2025-3936)

    Vulnerability from nvd – Published: 2025-05-22 12:20 – Updated: 2025-05-22 17:29
    VLAI
    Title
    Incorrect Permission Assignment for Critical Resource
    Summary
    Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-732 - Incorrect Permission Assignment for Critical Resource
    Assigner
    References
    Impacted products
    Vendor Product Version
    Tridium Niagara Framework Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Tridium Niagara Enterprise Security Affected: 0 , < 4.14.2 (custom)
    Affected: 0 , < 4.15.1 (custom)
    Affected: 0 , < 4.10.11 (custom)
    		Create a notification for this product.
    Date Public
    2025-05-08 16:59
    Credits
    Andrea Palanca and team at Nozomi Networks
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3936",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T17:19:05.444995Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T17:29:38.532Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows"
          ],
          "product": "Niagara Framework",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows"
          ],
          "product": "Niagara Enterprise Security",
          "vendor": "Tridium",
          "versions": [
            {
              "lessThan": "4.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrea Palanca and team at Nozomi Networks"
        }
      ],
      "datePublic": "2025-05-08T16:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u0026nbsp;Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.\u003cbr\u003e"
            }
          ],
          "value": "Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-22T12:50:32.521Z",
        "orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
        "shortName": "Honeywell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.niagara-community.com/category/tech_bull"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.honeywell.com/us/en/product-security#security-notices"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Incorrect Permission Assignment for Critical Resource",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
    "assignerShortName": "Honeywell",
    "cveId": "CVE-2025-3936",
    "datePublished": "2025-05-22T12:20:42.337Z",
    "dateReserved": "2025-04-25T15:21:09.014Z",
    "dateUpdated": "2025-05-22T17:29:38.532Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    VAR-201302-0028

    Vulnerability from variot - Updated: 2023-12-18 13:53

    Directory traversal vulnerability in Tridium Niagara AX 3.5, 3.6, and 3.7 allows remote attackers to read sensitive files, and consequently execute arbitrary code, by leveraging (1) valid credentials or (2) the guest feature. Tridium Niagara is a building monitoring system. TRIDIUM NiagaraAX is prone to a directory-traversal vulnerability. This may aid in further attacks. A directory traversal vulnerability exists in Tridium Niagara AX versions 3.5, 3.6 and 3.7

    Show details on source website
    To clipboard 

    {
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201302-0028",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "niagara ax",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "tridium",
        "version": "3.6"
      },
      {
        "model": "niagara ax",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "tridium",
        "version": "3.5"
      },
      {
        "model": "niagara ax",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "tridium",
        "version": "3.7"
      },
      {
        "model": "niagara ax framework",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "tridium",
        "version": "3.5"
      },
      {
        "model": "niagara ax framework",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "tridium",
        "version": "3.6"
      },
      {
        "model": "niagara ax framework",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "tridium",
        "version": "3.7"
      },
      {
        "model": "niagara ax",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "tridium",
        "version": "3.5/3.6/3.7"
      },
      {
        "model": "niagra ax framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "tridium",
        "version": "3.5"
      },
      {
        "model": "niagra ax framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "tridium",
        "version": "3.6"
      },
      {
        "model": "niagra ax framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "tridium",
        "version": "3.7"
      },
      {
        "model": "niagaraax",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "tridium",
        "version": "3.7"
      },
      {
        "model": "niagaraax",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "tridium",
        "version": "3.6"
      },
      {
        "model": "niagaraax",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "tridium",
        "version": "0"
      },
      {
        "model": "niagaraax",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "tridium",
        "version": "3.7.46.3"
      },
      {
        "model": "niagaraax",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "tridium",
        "version": "3.6.47.1"
      },
      {
        "model": "niagaraax",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "tridium",
        "version": "3.5.39"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "niagra ax framework",
        "version": "3.5"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "niagra ax framework",
        "version": "3.6"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "niagra ax framework",
        "version": "3.7"
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "170be9f4-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2013-01004"
      },
      {
        "db": "BID",
        "id": "57968"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-001581"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-4701"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201302-264"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:tridium:niagara_ax:3.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tridium:niagara_ax:3.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tridium:niagara_ax:3.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2012-4701"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Billy Rios and Terry McCorkle",
    "sources": [
      {
        "db": "BID",
        "id": "57968"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2012-4701",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.3,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.6,
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Complete",
            "baseScore": 9.3,
            "confidentialityImpact": "Complete",
            "exploitabilityScore": null,
            "id": "CVE-2012-4701",
            "impactScore": null,
            "integrityImpact": "Complete",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "IVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.3,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.6,
            "id": "170be9f4-2353-11e6-abef-000c29c66e3d",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.2,
            "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
            "version": "2.9 [IVD]"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.3,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.6,
            "id": "VHN-57982",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2012-4701",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201302-264",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "IVD",
            "id": "170be9f4-2353-11e6-abef-000c29c66e3d",
            "trust": 0.2,
            "value": "CRITICAL"
          },
          {
            "author": "VULHUB",
            "id": "VHN-57982",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "170be9f4-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "VULHUB",
        "id": "VHN-57982"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-001581"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-4701"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201302-264"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Directory traversal vulnerability in Tridium Niagara AX 3.5, 3.6, and 3.7 allows remote attackers to read sensitive files, and consequently execute arbitrary code, by leveraging (1) valid credentials or (2) the guest feature. Tridium Niagara is a building monitoring system. TRIDIUM NiagaraAX is prone to a directory-traversal vulnerability. This may aid in further attacks. A directory traversal vulnerability exists in Tridium Niagara AX versions 3.5, 3.6 and 3.7",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2012-4701"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-001581"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2013-01004"
      },
      {
        "db": "BID",
        "id": "57968"
      },
      {
        "db": "IVD",
        "id": "170be9f4-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "VULHUB",
        "id": "VHN-57982"
      }
    ],
    "trust": 2.7
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2012-4701",
        "trust": 3.6
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-13-045-01",
        "trust": 3.4
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201302-264",
        "trust": 0.9
      },
      {
        "db": "CNVD",
        "id": "CNVD-2013-01004",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-001581",
        "trust": 0.8
      },
      {
        "db": "BID",
        "id": "57968",
        "trust": 0.4
      },
      {
        "db": "IVD",
        "id": "170BE9F4-2353-11E6-ABEF-000C29C66E3D",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-57982",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "170be9f4-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2013-01004"
      },
      {
        "db": "VULHUB",
        "id": "VHN-57982"
      },
      {
        "db": "BID",
        "id": "57968"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-001581"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-4701"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201302-264"
      }
    ]
  },
  "id": "VAR-201302-0028",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "170be9f4-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2013-01004"
      },
      {
        "db": "VULHUB",
        "id": "VHN-57982"
      }
    ],
    "trust": 1.55093956
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "170be9f4-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2013-01004"
      }
    ]
  },
  "last_update_date": "2023-12-18T13:53:30.400000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Niagara AX Security Patch 11-Feb-2013",
        "trust": 0.8,
        "url": "https://www.niagara-central.com/ord?portal:/dev/wiki/niagara_ax_security_patch_11-feb-2013"
      },
      {
        "title": "TRIDIUM NiagaraAX Directory Traversal Vulnerability Patch",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/31881"
      },
      {
        "title": "securityPatches3.7_120211",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=45360"
      },
      {
        "title": "securityPatches3.6_120211",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=45359"
      },
      {
        "title": "securityPatches3.5_120211",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=45358"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2013-01004"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-001581"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201302-264"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-22",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-57982"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-001581"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-4701"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.4,
        "url": "http://ics-cert.us-cert.gov/pdf/icsa-13-045-01.pdf"
      },
      {
        "trust": 1.7,
        "url": "https://www.niagara-central.com/ord?portal:/dev/wiki/niagara_ax_security_patch_11-feb-2013"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-4701"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-4701"
      },
      {
        "trust": 0.3,
        "url": "http://www.niagaraax.com/"
      },
      {
        "trust": 0.3,
        "url": "http://www.tridium.com/cs/products_/_services/niagaraax"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2013-01004"
      },
      {
        "db": "VULHUB",
        "id": "VHN-57982"
      },
      {
        "db": "BID",
        "id": "57968"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-001581"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-4701"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201302-264"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "IVD",
        "id": "170be9f4-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2013-01004"
      },
      {
        "db": "VULHUB",
        "id": "VHN-57982"
      },
      {
        "db": "BID",
        "id": "57968"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-001581"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-4701"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201302-264"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2013-02-19T00:00:00",
        "db": "IVD",
        "id": "170be9f4-2353-11e6-abef-000c29c66e3d"
      },
      {
        "date": "2013-02-19T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2013-01004"
      },
      {
        "date": "2013-02-15T00:00:00",
        "db": "VULHUB",
        "id": "VHN-57982"
      },
      {
        "date": "2013-02-14T00:00:00",
        "db": "BID",
        "id": "57968"
      },
      {
        "date": "2013-02-18T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2013-001581"
      },
      {
        "date": "2013-02-15T12:09:27.773000",
        "db": "NVD",
        "id": "CVE-2012-4701"
      },
      {
        "date": "2013-02-20T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201302-264"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2013-05-24T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2013-01004"
      },
      {
        "date": "2013-02-15T00:00:00",
        "db": "VULHUB",
        "id": "VHN-57982"
      },
      {
        "date": "2013-02-14T00:00:00",
        "db": "BID",
        "id": "57968"
      },
      {
        "date": "2013-02-18T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2013-001581"
      },
      {
        "date": "2023-03-22T14:11:31.713000",
        "db": "NVD",
        "id": "CVE-2012-4701"
      },
      {
        "date": "2023-03-23T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201302-264"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201302-264"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "TRIDIUM NiagaraAX Directory Traversal Vulnerability",
    "sources": [
      {
        "db": "IVD",
        "id": "170be9f4-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2013-01004"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Path traversal",
    "sources": [
      {
        "db": "IVD",
        "id": "170be9f4-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201302-264"
      }
    ],
    "trust": 0.8
  }
}

    VAR-202008-0160

    Vulnerability from variot - Updated: 2023-12-18 13:47

    A timeout during a TLS handshake can result in the connection failing to terminate. This can result in a Niagara thread hanging and requires a manual restart of Niagara (Versions 4.6.96.28, 4.7.109.20, 4.7.110.32, 4.8.0.110) and Niagara Enterprise Security (Versions 2.4.31, 2.4.45, 4.8.0.35) to correct. Tridium Provides Niagara Is a building automation system. As a result, threads on the system may hang and a manual reboot is required for recovery. Niagara is a platform used to support the connection of devices and applications. Attackers can use the vulnerability to cause the Niagara thread to hang

    Show details on source website
    To clipboard 

    {
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202008-0160",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "niagara",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "tridium",
        "version": "4.6.96.28"
      },
      {
        "model": "niagara",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "tridium",
        "version": "4.7.109.20"
      },
      {
        "model": "niagara",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "tridium",
        "version": "4.7.110.32"
      },
      {
        "model": "niagara",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "tridium",
        "version": "4.8.0.110"
      },
      {
        "model": "niagara enterprise security",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "tridium",
        "version": "2.4.31"
      },
      {
        "model": "niagara enterprise security",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "tridium",
        "version": "2.4.45"
      },
      {
        "model": "niagara enterprise security",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "tridium",
        "version": "4.8.0.35"
      },
      {
        "model": "niagara",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "tridium",
        "version": "4.6.96.28\u3001 4.7.109.20\u3001 4.7.110.32\u3001 4.8.0.110"
      },
      {
        "model": "niagara enterprise security",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "tridium",
        "version": "2.4.31\u3001 2.4.45\u3001 4.8.0.35"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-49618"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-007432"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-14483"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:tridium:niagara:4.6.96.28:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tridium:niagara:4.7.109.20:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tridium:niagara:4.7.110.32:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tridium:niagara:4.8.0.110:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tridium:niagara_enterprise_security:2.4.31:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tridium:niagara_enterprise_security:2.4.45:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tridium:niagara_enterprise_security:4.8.0.35:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-14483"
      }
    ]
  },
  "cve": "CVE-2020-14483",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "ADJACENT_NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 3.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 6.5,
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "LOW",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "ADJACENT_NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 3.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 6.5,
            "id": "CNVD-2020-49618",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "LOW",
            "trust": 0.6,
            "vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "author": "NVD",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 2.8,
            "impactScore": 1.4,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Adjacent Network",
            "author": "IPA score",
            "availabilityImpact": "Low",
            "baseScore": 4.3,
            "baseSeverity": "Medium",
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "JVNDB-2020-007432",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2020-14483",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "IPA",
            "id": "JVNDB-2020-007432",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2020-49618",
            "trust": 0.6,
            "value": "LOW"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202008-593",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-49618"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-007432"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-14483"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202008-593"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A timeout during a TLS handshake can result in the connection failing to terminate. This can result in a Niagara thread hanging and requires a manual restart of Niagara (Versions 4.6.96.28, 4.7.109.20, 4.7.110.32, 4.8.0.110) and Niagara Enterprise Security (Versions 2.4.31, 2.4.45, 4.8.0.35) to correct. Tridium Provides Niagara Is a building automation system. As a result, threads on the system may hang and a manual reboot is required for recovery. Niagara is a platform used to support the connection of devices and applications. Attackers can use the vulnerability to cause the Niagara thread to hang",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-14483"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-007432"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-49618"
      }
    ],
    "trust": 2.16
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2020-14483",
        "trust": 3.0
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-20-224-03",
        "trust": 3.0
      },
      {
        "db": "JVN",
        "id": "JVNVU99362875",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-007432",
        "trust": 0.8
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-49618",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.2762",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202008-593",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-49618"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-007432"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-14483"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202008-593"
      }
    ]
  },
  "id": "VAR-202008-0160",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-49618"
      }
    ],
    "trust": 0.9333333399999999
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-49618"
      }
    ]
  },
  "last_update_date": "2023-12-18T13:47:24.791000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "SB 2020-Tridium-2(PDF)",
        "trust": 0.8,
        "url": "https://www.tridium.com/~/media/tridium/library/documents/sb2020-tridium-2"
      },
      {
        "title": "Patch for Tridium Niagara and Niagara Enterprise Security have unspecified vulnerabilities",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/232405"
      },
      {
        "title": "Tridium Niagara  and Niagara Enterprise Security Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=126632"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-49618"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-007432"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202008-593"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-Other",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-14483"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.0,
        "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-224-03"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-14483"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/cert/jvnvu99362875"
      },
      {
        "trust": 0.6,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14483"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.2762/"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-49618"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-007432"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-14483"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202008-593"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-49618"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-007432"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-14483"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202008-593"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-08-31T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2020-49618"
      },
      {
        "date": "2020-08-13T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-007432"
      },
      {
        "date": "2020-08-13T15:15:12.377000",
        "db": "NVD",
        "id": "CVE-2020-14483"
      },
      {
        "date": "2020-08-11T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202008-593"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-08-31T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2020-49618"
      },
      {
        "date": "2020-08-13T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-007432"
      },
      {
        "date": "2020-08-19T20:58:30.487000",
        "db": "NVD",
        "id": "CVE-2020-14483"
      },
      {
        "date": "2020-08-20T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202008-593"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote or local",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202008-593"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Tridium Made  Niagara Vulnerability that remote connection terminal does not time out",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-007432"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "other",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202008-593"
      }
    ],
    "trust": 0.6
  }
}

    VAR-201808-0129

    Vulnerability from variot - Updated: 2023-12-18 13:33

    An attacker can log into the local Niagara platform (Niagara AX Framework Versions 3.8 and prior or Niagara 4 Framework Versions 4.4 and prior) using a disabled account name and a blank password, granting the attacker administrator access to the Niagara system. Niagara The platform contains authentication vulnerabilities.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Tridium Niagara AX Framework and Niagara 4 Framework are both IoT business application frameworks from Tridium. Tridium Niagara is prone to directory-traversal vulnerability and authentication-bypass vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploiting these issues may allow an attacker to bypass authentication and perform unauthorized actions on the affected application, and to obtain sensitive information that could aid in further attacks

    Show details on source website
    To clipboard 

    {
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201808-0129",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "niagara",
        "scope": "lte",
        "trust": 1.8,
        "vendor": "tridium",
        "version": "4.4"
      },
      {
        "model": "niagara ax framework",
        "scope": "lte",
        "trust": 1.8,
        "vendor": "tridium",
        "version": "3.8"
      },
      {
        "model": "niagara ax framework",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "tridium",
        "version": "3.8"
      },
      {
        "model": "niagara ax framework",
        "scope": "lte",
        "trust": 0.6,
        "vendor": "tridium",
        "version": "\u003c=3.8"
      },
      {
        "model": "niagara framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "tridium",
        "version": "4\u003c=4.4"
      },
      {
        "model": "niagara",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "tridium",
        "version": "4.4"
      },
      {
        "model": "framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "tridium",
        "version": "44.4"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "niagara",
        "version": "*"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "niagara ax framework",
        "version": "*"
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "e2f81210-39ab-11e9-ad51-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-15732"
      },
      {
        "db": "BID",
        "id": "105101"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-009181"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-16748"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201808-569"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:tridium:niagara:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "4.4",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tridium:niagara_ax_framework:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "3.8",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-16748"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Johnathan Gains and Leet Cyber Security.",
    "sources": [
      {
        "db": "BID",
        "id": "105101"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201808-569"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2017-16748",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 7.5,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "CVE-2017-16748",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.9,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "HIGH",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 6.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 1.9,
            "id": "CNVD-2018-15732",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "MEDIUM",
            "trust": 0.6,
            "vectorString": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "HIGH",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "IVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 6.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 1.9,
            "id": "e2f81210-39ab-11e9-ad51-000c29342cb1",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "MEDIUM",
            "trust": 0.2,
            "vectorString": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
            "version": "2.9 [IVD]"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 9.8,
            "baseSeverity": "Critical",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2017-16748",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2017-16748",
            "trust": 1.8,
            "value": "CRITICAL"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2018-15732",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201808-569",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "IVD",
            "id": "e2f81210-39ab-11e9-ad51-000c29342cb1",
            "trust": 0.2,
            "value": "CRITICAL"
          },
          {
            "author": "VULMON",
            "id": "CVE-2017-16748",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "e2f81210-39ab-11e9-ad51-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-15732"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-16748"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-009181"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-16748"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201808-569"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "An attacker can log into the local Niagara platform (Niagara AX Framework Versions 3.8 and prior or Niagara 4 Framework Versions 4.4 and prior) using a disabled account name and a blank password, granting the attacker administrator access to the Niagara system. Niagara The platform contains authentication vulnerabilities.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Tridium Niagara AX Framework and Niagara 4 Framework are both IoT business application frameworks from Tridium. Tridium Niagara is prone to directory-traversal vulnerability and authentication-bypass vulnerability because the application fails to sufficiently sanitize user-supplied input. \nExploiting these issues may allow an attacker to bypass authentication and perform unauthorized actions on the affected application, and to obtain sensitive information that could aid in further attacks",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-16748"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-009181"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-15732"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201808-569"
      },
      {
        "db": "BID",
        "id": "105101"
      },
      {
        "db": "IVD",
        "id": "e2f81210-39ab-11e9-ad51-000c29342cb1"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-16748"
      }
    ],
    "trust": 3.24
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-16748",
        "trust": 3.6
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-18-191-03",
        "trust": 3.4
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-19-022-01",
        "trust": 2.8
      },
      {
        "db": "BID",
        "id": "105101",
        "trust": 2.0
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-15732",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201808-569",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-009181",
        "trust": 0.8
      },
      {
        "db": "IVD",
        "id": "E2F81210-39AB-11E9-AD51-000C29342CB1",
        "trust": 0.2
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-16748",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "e2f81210-39ab-11e9-ad51-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-15732"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-16748"
      },
      {
        "db": "BID",
        "id": "105101"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-009181"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-16748"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201808-569"
      }
    ]
  },
  "id": "VAR-201808-0129",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "e2f81210-39ab-11e9-ad51-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-15732"
      }
    ],
    "trust": 1.52385621
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "e2f81210-39ab-11e9-ad51-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-15732"
      }
    ]
  },
  "last_update_date": "2023-12-18T13:33:44.187000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "https://www.tridium.com/"
      },
      {
        "title": "Patch for Tridium Niagara AX Framework and Niagara 4 Framework Authentication Bypass Vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/138005"
      },
      {
        "title": "Tridium Niagara AX Framework  and Niagara 4 Framework Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=84155"
      },
      {
        "title": "CVE-2017-16744-and-CVE-2017-16748-Tridium-Niagara",
        "trust": 0.1,
        "url": "https://github.com/gainsec/cve-2017-16744-and-cve-2017-16748-tridium-niagara "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/khulnasoft-labs/awesome-security "
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-15732"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-16748"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-009181"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201808-569"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-287",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-009181"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-16748"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.4,
        "url": "https://ics-cert.us-cert.gov/advisories/icsa-18-191-03"
      },
      {
        "trust": 2.9,
        "url": "https://ics-cert.us-cert.gov/advisories/icsa-19-022-01"
      },
      {
        "trust": 2.3,
        "url": "http://www.securityfocus.com/bid/105101"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-16748"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-16748"
      },
      {
        "trust": 0.3,
        "url": "https://www.tridium.com/"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/287.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/gainsec/cve-2017-16744-and-cve-2017-16748-tridium-niagara"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-15732"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-16748"
      },
      {
        "db": "BID",
        "id": "105101"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-009181"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-16748"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201808-569"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "IVD",
        "id": "e2f81210-39ab-11e9-ad51-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-15732"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-16748"
      },
      {
        "db": "BID",
        "id": "105101"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-009181"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-16748"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201808-569"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-08-21T00:00:00",
        "db": "IVD",
        "id": "e2f81210-39ab-11e9-ad51-000c29342cb1"
      },
      {
        "date": "2018-08-21T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2018-15732"
      },
      {
        "date": "2018-08-20T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-16748"
      },
      {
        "date": "2018-08-16T00:00:00",
        "db": "BID",
        "id": "105101"
      },
      {
        "date": "2018-11-09T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-009181"
      },
      {
        "date": "2018-08-20T21:29:00.807000",
        "db": "NVD",
        "id": "CVE-2017-16748"
      },
      {
        "date": "2018-08-20T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201808-569"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-08-21T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2018-15732"
      },
      {
        "date": "2019-04-03T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-16748"
      },
      {
        "date": "2019-01-23T07:00:00",
        "db": "BID",
        "id": "105101"
      },
      {
        "date": "2019-01-23T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-009181"
      },
      {
        "date": "2019-04-03T22:29:00.650000",
        "db": "NVD",
        "id": "CVE-2017-16748"
      },
      {
        "date": "2019-04-04T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201808-569"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201808-569"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Niagara Authentication vulnerabilities in the platform",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-009181"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "authorization issue",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201808-569"
      }
    ],
    "trust": 0.6
  }
}

    VAR-201808-0077

    Vulnerability from variot - Updated: 2023-12-18 13:33

    A path traversal vulnerability in Tridium Niagara AX Versions 3.8 and prior and Niagara 4 systems Versions 4.4 and prior installed on Microsoft Windows Systems can be exploited by leveraging valid platform (administrator) credentials. Tridium Niagara AX Framework and Niagara 4 Framework are both IoT business application frameworks from Tridium. The vulnerability stems from the program's insufficient filtering of user-submitted input. A remote attacker could use this vulnerability to obtain sensitive information with valid platform administrator credentials. Tridium Niagara is prone to directory-traversal vulnerability and authentication-bypass vulnerability because the application fails to sufficiently sanitize user-supplied input

    Show details on source website
    To clipboard 

    {
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201808-0077",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "niagara ax framework",
        "scope": "lte",
        "trust": 1.8,
        "vendor": "tridium",
        "version": "3.8"
      },
      {
        "model": "niagara",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "tridium",
        "version": "4.4"
      },
      {
        "model": "niagara",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "tridium",
        "version": "4.0"
      },
      {
        "model": "niagara ax framework",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "tridium",
        "version": "3.8"
      },
      {
        "model": "niagara",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "tridium",
        "version": "4 systems 4.4"
      },
      {
        "model": "niagara ax framework",
        "scope": "lte",
        "trust": 0.6,
        "vendor": "tridium",
        "version": "\u003c=3.8"
      },
      {
        "model": "niagara framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "tridium",
        "version": "4\u003c=4.4"
      },
      {
        "model": "niagara",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "tridium",
        "version": "4.2"
      },
      {
        "model": "niagara",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "tridium",
        "version": "4.4"
      },
      {
        "model": "niagara",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "tridium",
        "version": "4.0"
      },
      {
        "model": "niagara",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "tridium",
        "version": "4.3"
      },
      {
        "model": "niagara",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "tridium",
        "version": "4.1"
      },
      {
        "model": "framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "tridium",
        "version": "44.4"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "niagara",
        "version": "*"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "niagara ax framework",
        "version": "*"
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "e2f8391e-39ab-11e9-8682-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-15731"
      },
      {
        "db": "BID",
        "id": "105101"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-014181"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-16744"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201808-568"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:tridium:niagara_ax_framework:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "3.8",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tridium:niagara:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "4.4",
                "versionStartIncluding": "4.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-16744"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Johnathan Gains and Leet Cyber Security.",
    "sources": [
      {
        "db": "BID",
        "id": "105101"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201808-568"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2017-16744",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.0,
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "Single",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 6.5,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "CVE-2017-16744",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.9,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.6,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 4.9,
            "id": "CNVD-2018-15731",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "IVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.6,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 4.9,
            "id": "e2f8391e-39ab-11e9-8682-000c29342cb1",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.2,
            "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
            "version": "2.9 [IVD]"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.2,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.2,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2017-16744",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "High",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2017-16744",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2018-15731",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201808-568",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "IVD",
            "id": "e2f8391e-39ab-11e9-8682-000c29342cb1",
            "trust": 0.2,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2017-16744",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "e2f8391e-39ab-11e9-8682-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-15731"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-16744"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-014181"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-16744"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201808-568"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A path traversal vulnerability in Tridium Niagara AX Versions 3.8 and prior and Niagara 4 systems Versions 4.4 and prior installed on Microsoft Windows Systems can be exploited by leveraging valid platform (administrator) credentials. Tridium Niagara AX Framework and Niagara 4 Framework are both IoT business application frameworks from Tridium. The vulnerability stems from the program\u0027s insufficient filtering of user-submitted input. A remote attacker could use this vulnerability to obtain sensitive information with valid platform administrator credentials. Tridium Niagara is prone to directory-traversal vulnerability and authentication-bypass vulnerability because the application fails to sufficiently sanitize user-supplied input",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-16744"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-014181"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-15731"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201808-568"
      },
      {
        "db": "BID",
        "id": "105101"
      },
      {
        "db": "IVD",
        "id": "e2f8391e-39ab-11e9-8682-000c29342cb1"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-16744"
      }
    ],
    "trust": 3.24
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-16744",
        "trust": 3.6
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-18-191-03",
        "trust": 3.4
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-19-022-01",
        "trust": 2.8
      },
      {
        "db": "BID",
        "id": "105101",
        "trust": 2.0
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-15731",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201808-568",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-014181",
        "trust": 0.8
      },
      {
        "db": "IVD",
        "id": "E2F8391E-39AB-11E9-8682-000C29342CB1",
        "trust": 0.2
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-16744",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "e2f8391e-39ab-11e9-8682-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-15731"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-16744"
      },
      {
        "db": "BID",
        "id": "105101"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-014181"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-16744"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201808-568"
      }
    ]
  },
  "id": "VAR-201808-0077",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "e2f8391e-39ab-11e9-8682-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-15731"
      }
    ],
    "trust": 1.52385621
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "e2f8391e-39ab-11e9-8682-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-15731"
      }
    ]
  },
  "last_update_date": "2023-12-18T13:33:44.149000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "New Security Update Releases for Niagara AX and Niagara 4",
        "trust": 0.8,
        "url": "https://www.tridium.com/~/media/tridium/library/documents/niagara%20ax%2038%20update%204niagara%2044%20update%201.ashx?la=en"
      },
      {
        "title": "Patch for Tridium Niagara AX Framework and Niagara 4 Framework Path Traversal Vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/138001"
      },
      {
        "title": "Tridium Niagara AX Framework  and Niagara 4 Framework Repair measures for path traversal vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=84154"
      },
      {
        "title": "CVE-2017-16744-and-CVE-2017-16748-Tridium-Niagara",
        "trust": 0.1,
        "url": "https://github.com/gainsec/cve-2017-16744-and-cve-2017-16748-tridium-niagara "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/khulnasoft-labs/awesome-security "
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-15731"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-16744"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-014181"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201808-568"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-22",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-014181"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-16744"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.4,
        "url": "https://ics-cert.us-cert.gov/advisories/icsa-18-191-03"
      },
      {
        "trust": 2.9,
        "url": "https://ics-cert.us-cert.gov/advisories/icsa-19-022-01"
      },
      {
        "trust": 2.3,
        "url": "http://www.securityfocus.com/bid/105101"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-16744"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-16744"
      },
      {
        "trust": 0.3,
        "url": "https://www.tridium.com/"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/22.html"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/gainsec/cve-2017-16744-and-cve-2017-16748-tridium-niagara"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-15731"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-16744"
      },
      {
        "db": "BID",
        "id": "105101"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-014181"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-16744"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201808-568"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "IVD",
        "id": "e2f8391e-39ab-11e9-8682-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-15731"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-16744"
      },
      {
        "db": "BID",
        "id": "105101"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-014181"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-16744"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201808-568"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-08-21T00:00:00",
        "db": "IVD",
        "id": "e2f8391e-39ab-11e9-8682-000c29342cb1"
      },
      {
        "date": "2018-08-21T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2018-15731"
      },
      {
        "date": "2018-08-20T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-16744"
      },
      {
        "date": "2018-08-16T00:00:00",
        "db": "BID",
        "id": "105101"
      },
      {
        "date": "2018-11-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-014181"
      },
      {
        "date": "2018-08-20T21:29:00.683000",
        "db": "NVD",
        "id": "CVE-2017-16744"
      },
      {
        "date": "2018-08-20T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201808-568"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-08-21T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2018-15731"
      },
      {
        "date": "2019-04-03T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-16744"
      },
      {
        "date": "2019-01-23T07:00:00",
        "db": "BID",
        "id": "105101"
      },
      {
        "date": "2019-01-23T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-014181"
      },
      {
        "date": "2019-04-03T22:29:00.510000",
        "db": "NVD",
        "id": "CVE-2017-16744"
      },
      {
        "date": "2019-04-04T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201808-568"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201808-568"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Tridium Niagara AX Framework and Niagara 4 Framework Path Traversal Vulnerability",
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-15731"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201808-568"
      }
    ],
    "trust": 1.2
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Path traversal",
    "sources": [
      {
        "db": "IVD",
        "id": "e2f8391e-39ab-11e9-8682-000c29342cb1"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201808-568"
      }
    ],
    "trust": 0.8
  }
}

    VAR-201901-0860

    Vulnerability from variot - Updated: 2023-12-18 13:28

    Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4 a cross-site scripting vulnerability has been identified that may allow a remote attacker to inject code to some web pages affecting confidentiality. plural Tridium Niagara Product Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. Multiple Tridium Products are prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks

    Show details on source website
    To clipboard 

    {
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201901-0860",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "niagara",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "tridium",
        "version": "4.4.93.40.2"
      },
      {
        "model": "niagara ax framework",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "tridium",
        "version": "3.8.401.1"
      },
      {
        "model": "niagara enterprise security",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "tridium",
        "version": "2.3.118.6"
      },
      {
        "model": "niagara",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "tridium",
        "version": "4.6"
      },
      {
        "model": "niagara ax framework",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "tridium",
        "version": "3.8u4"
      },
      {
        "model": "niagara enterprise security",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "tridium",
        "version": "2.3u1"
      },
      {
        "model": "niagara",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "tridium",
        "version": "4.4u2"
      },
      {
        "model": "niagara",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "tridium",
        "version": "4.6.96.28.4"
      },
      {
        "model": "niagara",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "tridium",
        "version": "4.4u2 4.4.93.40.2"
      },
      {
        "model": "niagara",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "tridium",
        "version": "niagara 4.6 4.6.96.28.4"
      },
      {
        "model": "niagara ax framework",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "tridium",
        "version": "3.8u4 3.8.401.1"
      },
      {
        "model": "niagara enterprise security",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "tridium",
        "version": "2.3u1 2.3.118.6"
      },
      {
        "model": "niagara enterprise security 2.3u1",
        "scope": null,
        "trust": 0.3,
        "vendor": "tridium",
        "version": null
      },
      {
        "model": "niagara ax 3.8u4",
        "scope": null,
        "trust": 0.3,
        "vendor": "tridium",
        "version": null
      },
      {
        "model": "niagara",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "tridium",
        "version": "4.6"
      },
      {
        "model": "niagara 4.4u2",
        "scope": null,
        "trust": 0.3,
        "vendor": "tridium",
        "version": null
      },
      {
        "model": "niagara enterprise security",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "tridium",
        "version": "2.3.118.6"
      },
      {
        "model": "niagara ax",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "tridium",
        "version": "3.8.401.1"
      },
      {
        "model": "niagara",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "tridium",
        "version": "4.6.96.28.4"
      },
      {
        "model": "niagara",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "tridium",
        "version": "4.4.93.40.2"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "106530"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013990"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-18985"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:tridium:niagara_enterprise_security:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.3.118.6",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tridium:niagara_ax_framework:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "3.8.401.1",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tridium:niagara:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.6.96.28.4",
                "versionStartIncluding": "4.6",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tridium:niagara:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.4.93.40.2",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tridium:niagara_enterprise_security:2.3u1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tridium:niagara:4.4u2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tridium:niagara_ax_framework:3.8u4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-18985"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Daniel Santos and Elisa Costante of SecurityMatters",
    "sources": [
      {
        "db": "BID",
        "id": "106530"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-430"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2018-18985",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 6.8,
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "LOW",
            "trust": 1.0,
            "userInteractionRequired": true,
            "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Network",
            "authentication": "Single",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 3.5,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2018-18985",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Low",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 2.3,
            "impactScore": 2.7,
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 5.4,
            "baseSeverity": "Medium",
            "confidentialityImpact": "Low",
            "exploitabilityScore": null,
            "id": "CVE-2018-18985",
            "impactScore": null,
            "integrityImpact": "Low",
            "privilegesRequired": "Low",
            "scope": "Changed",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2018-18985",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201901-430",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013990"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-18985"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-430"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4 a cross-site scripting vulnerability has been identified that may allow a remote attacker to inject code to some web pages affecting confidentiality. plural Tridium Niagara Product Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. Multiple Tridium Products are prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. \nAn attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-18985"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013990"
      },
      {
        "db": "BID",
        "id": "106530"
      }
    ],
    "trust": 1.89
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "ICS CERT",
        "id": "ICSA-18-333-02",
        "trust": 2.7
      },
      {
        "db": "NVD",
        "id": "CVE-2018-18985",
        "trust": 2.7
      },
      {
        "db": "BID",
        "id": "106530",
        "trust": 1.9
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013990",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-430",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "106530"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013990"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-18985"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-430"
      }
    ]
  },
  "id": "VAR-201901-0860",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.54507082
  },
  "last_update_date": "2023-12-18T13:28:39.950000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "https://www.tridium.com/"
      },
      {
        "title": "TRIDIUM Niagara Enterprise Security , Niagara AX  and Niagara Fixes for cross-site scripting vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=88589"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013990"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-430"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-79",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013990"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-18985"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.7,
        "url": "https://ics-cert.us-cert.gov/advisories/icsa-18-333-02"
      },
      {
        "trust": 2.2,
        "url": "http://www.securityfocus.com/bid/106530"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-18985"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-18985"
      },
      {
        "trust": 0.3,
        "url": "https://www.tridium.com/"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "106530"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013990"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-18985"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-430"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "106530"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013990"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-18985"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-430"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-01-10T00:00:00",
        "db": "BID",
        "id": "106530"
      },
      {
        "date": "2019-03-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-013990"
      },
      {
        "date": "2019-01-29T16:29:00.483000",
        "db": "NVD",
        "id": "CVE-2018-18985"
      },
      {
        "date": "2019-01-14T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201901-430"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-01-10T00:00:00",
        "db": "BID",
        "id": "106530"
      },
      {
        "date": "2019-03-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-013990"
      },
      {
        "date": "2019-10-09T23:37:31.693000",
        "db": "NVD",
        "id": "CVE-2018-18985"
      },
      {
        "date": "2019-10-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201901-430"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-430"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "plural  Tridium Niagara Product Vulnerable to cross-site scripting",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013990"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "XSS",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-430"
      }
    ],
    "trust": 0.6
  }
}

    VAR-201909-0994

    Vulnerability from variot - Updated: 2023-12-18 13:13

    A specific utility may allow an attacker to gain read access to privileged files in the Niagara AX 3.8u4 (JACE 3e, JACE 6e, JACE 7, JACE-8000), Niagara 4.4u3 (JACE 3e, JACE 6e, JACE 7, JACE-8000), and Niagara 4.7u1 (JACE-8000, Edge 10). Niagara AX and Niagara Contains an authentication vulnerability.Information may be obtained

    Show details on source website
    To clipboard 

    {
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201909-0994",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "niagara ax",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "tridium",
        "version": "3.8u4"
      },
      {
        "model": "niagara4",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "tridium",
        "version": "4.4u3"
      },
      {
        "model": "niagara4",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "tridium",
        "version": "4.7u1"
      },
      {
        "model": "niagara",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "tridium",
        "version": "4.4u3"
      },
      {
        "model": "niagara",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "tridium",
        "version": "4.7u1"
      },
      {
        "model": "niagara ax framework",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "tridium",
        "version": "3.8u4"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-009666"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-13528"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:tridium:niagara_ax:3.8u4:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:tridium:jace_7:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:tridium:jace-8000:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:tridium:jace_6e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:tridium:jace_3e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:tridium:niagara4:4.4u3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:tridium:jace-8000:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:tridium:jace_6e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:tridium:jace_7:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:tridium:jace_3e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:tridium:niagara4:4.7u1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:tridium:jace-8000:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:tridium:edge_10:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-13528"
      }
    ]
  },
  "cve": "CVE-2019-13528",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 2.1,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 3.9,
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "LOW",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Local",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 2.1,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "CVE-2019-13528",
            "impactScore": null,
            "integrityImpact": "None",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Low",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 0.8,
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Local",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 4.4,
            "baseSeverity": "Medium",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2019-13528",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "High",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2019-13528",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201909-963",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-009666"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-13528"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201909-963"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A specific utility may allow an attacker to gain read access to privileged files in the Niagara AX 3.8u4 (JACE 3e, JACE 6e, JACE 7, JACE-8000), Niagara 4.4u3 (JACE 3e, JACE 6e, JACE 7, JACE-8000), and Niagara 4.7u1 (JACE-8000, Edge 10). Niagara AX and Niagara Contains an authentication vulnerability.Information may be obtained",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-13528"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-009666"
      }
    ],
    "trust": 1.62
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "ICS CERT",
        "id": "ICSA-19-262-01",
        "trust": 2.4
      },
      {
        "db": "NVD",
        "id": "CVE-2019-13528",
        "trust": 2.4
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-009666",
        "trust": 0.8
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.3561",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201909-963",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-009666"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-13528"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201909-963"
      }
    ]
  },
  "id": "VAR-201909-0994",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.65093956
  },
  "last_update_date": "2023-12-18T13:13:22.994000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "https://www.tridium.com/"
      },
      {
        "title": "ARC , Niagara AX  and Niagara Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=98449"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-009666"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201909-963"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-noinfo",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-287",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-009666"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-13528"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.4,
        "url": "https://www.us-cert.gov/ics/advisories/icsa-19-262-01"
      },
      {
        "trust": 1.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-13528"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-13528"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2019.3561/"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-009666"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-13528"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201909-963"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-009666"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-13528"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201909-963"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-09-26T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-009666"
      },
      {
        "date": "2019-09-24T22:15:13.013000",
        "db": "NVD",
        "id": "CVE-2019-13528"
      },
      {
        "date": "2019-09-20T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201909-963"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-09-26T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-009666"
      },
      {
        "date": "2020-10-16T13:18:24.897000",
        "db": "NVD",
        "id": "CVE-2019-13528"
      },
      {
        "date": "2020-10-21T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201909-963"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "local",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201909-963"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Niagara AX and  Niagara Authentication vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-009666"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "authorization issue",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201909-963"
      }
    ],
    "trust": 0.6
  }
}

    VAR-201509-0440

    Vulnerability from variot - Updated: 2023-12-18 12:51

    EasyIO EasyIO-30P-SF controllers with firmware before 0.5.21 and 2.x before 2.0.5.21, as used in Accutrol, Bar-Tech Automation, Infocon/EasyIO, Honeywell Automation India, Johnson Controls, SyxthSENSE, Transformative Wave Technologies, Tridium Asia Pacific, and Tridium Europe products, have a hardcoded password, which makes it easier for remote attackers to obtain access via unspecified vectors. EasyIO EasyIO-30P-SF is prone to a security-bypass vulnerability. A remote attacker may leverage this issue to gain access to the vulnerable device. EasyIO EasyIO-30P-SF is a 32-bit controller product developed by Malaysia EasyIO company and applied in DDC (direct digital control) system. A security vulnerability exists in EasyIO EasyIO-30P-SF controllers using firmware versions prior to 0.5.21 and 2.x versions prior to 2.0.5.21 due to the program's use of hard-coded passwords

    Show details on source website
    To clipboard 

    {
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201509-0440",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "easyio-30p-sf",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "easyio",
        "version": "*"
      },
      {
        "model": "easyio-30p-sf",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "easyio",
        "version": "0.5.20"
      },
      {
        "model": "easyio-30p-sf",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "easyio",
        "version": "2.0.5.20"
      },
      {
        "model": "easyio-30p-sf",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "easyio",
        "version": "2.0.5.21"
      },
      {
        "model": "easyio-30p-sf",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "easyio",
        "version": "2.x"
      },
      {
        "model": "easyio-30p-sf",
        "scope": null,
        "trust": 0.8,
        "vendor": "easyio",
        "version": null
      },
      {
        "model": "easyio-30p-sf",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "easyio",
        "version": "0.5.20"
      },
      {
        "model": "easyio-30p-sf",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "easyio",
        "version": "2.0.5.20"
      },
      {
        "model": "vykon ios30p",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "tridium",
        "version": "0"
      },
      {
        "model": "sedona controller point ios30p",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "tridium",
        "version": "30??0"
      },
      {
        "model": "ios30p sedona",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "tridium",
        "version": "0"
      },
      {
        "model": "catalyst cat-371",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "transformative wave",
        "version": "0"
      },
      {
        "model": "easyio 30p",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "syxthsense",
        "version": "0"
      },
      {
        "model": "controls field controller bacnet fc-30b",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "johnson",
        "version": "0"
      },
      {
        "model": "easyio-30p-sf45",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "infocon",
        "version": "0"
      },
      {
        "model": "easyio 30p",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "honeywell",
        "version": "0"
      },
      {
        "model": "easyio-30p-sf",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "easyio",
        "version": "0"
      },
      {
        "model": "automation bta sedona controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "bar tech",
        "version": "0"
      },
      {
        "model": "automation bta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "bar tech",
        "version": "10-300"
      },
      {
        "model": "llc easy io-30p-sf45 ac7100",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "accutrol",
        "version": "??0"
      },
      {
        "model": "easyio-30p-sf",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "easyio",
        "version": "0.5.21"
      },
      {
        "model": "easyio-30p-sf",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "easyio",
        "version": "2.0.5.21"
      },
      {
        "model": "automation bta sedona controller",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "bar tech",
        "version": "0.5.22"
      },
      {
        "model": "automation bta sedona controller",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "bar tech",
        "version": "2.0.5.22"
      },
      {
        "model": "automation bta",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "bar tech",
        "version": "10-300.5.22"
      },
      {
        "model": "automation bta",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "bar tech",
        "version": "10-302.0.5.22"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "76845"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004971"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-3974"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-565"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:easyio:easyio-30p-sf_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "2.0.5.20",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:easyio:easyio-30p-sf_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "0.5.20",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:easyio:easyio-30p-sf:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2015-3974"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Maxim Rupp",
    "sources": [
      {
        "db": "BID",
        "id": "76845"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2015-3974",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": true,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "NVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.0,
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "Single",
            "author": "NVD",
            "availabilityImpact": "Complete",
            "baseScore": 9.0,
            "confidentialityImpact": "Complete",
            "exploitabilityScore": null,
            "id": "CVE-2015-3974",
            "impactScore": null,
            "integrityImpact": "Complete",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.0,
            "id": "VHN-81935",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:S/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2015-3974",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201509-565",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "VULHUB",
            "id": "VHN-81935",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-81935"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004971"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-3974"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-565"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "EasyIO EasyIO-30P-SF controllers with firmware before 0.5.21 and 2.x before 2.0.5.21, as used in Accutrol, Bar-Tech Automation, Infocon/EasyIO, Honeywell Automation India, Johnson Controls, SyxthSENSE, Transformative Wave Technologies, Tridium Asia Pacific, and Tridium Europe products, have a hardcoded password, which makes it easier for remote attackers to obtain access via unspecified vectors. EasyIO EasyIO-30P-SF is prone to a security-bypass vulnerability. \nA remote attacker may leverage this issue to gain access to the vulnerable device. EasyIO EasyIO-30P-SF is a 32-bit controller product developed by Malaysia EasyIO company and applied in DDC (direct digital control) system. A security vulnerability exists in EasyIO EasyIO-30P-SF controllers using firmware versions prior to 0.5.21 and 2.x versions prior to 2.0.5.21 due to the program\u0027s use of hard-coded passwords",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2015-3974"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004971"
      },
      {
        "db": "BID",
        "id": "76845"
      },
      {
        "db": "VULHUB",
        "id": "VHN-81935"
      }
    ],
    "trust": 1.98
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2015-3974",
        "trust": 2.8
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-15-237-02",
        "trust": 2.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004971",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-565",
        "trust": 0.7
      },
      {
        "db": "BID",
        "id": "76845",
        "trust": 0.4
      },
      {
        "db": "VULHUB",
        "id": "VHN-81935",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-81935"
      },
      {
        "db": "BID",
        "id": "76845"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004971"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-3974"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-565"
      }
    ]
  },
  "id": "VAR-201509-0440",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-81935"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T12:51:40.061000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "EasyIO-30P-SF",
        "trust": 0.8,
        "url": "http://www.easyio.com/easyio-30p-sf"
      },
      {
        "title": "EasyIO EasyIO-30P-SF Fixes for controller trust management vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=57821"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004971"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-565"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-255",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-81935"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004971"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-3974"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.8,
        "url": "https://ics-cert.us-cert.gov/advisories/icsa-15-237-02"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-3974"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-3974"
      },
      {
        "trust": 0.3,
        "url": "http://www.easyio.com/easyio-30p-sf"
      },
      {
        "trust": 0.3,
        "url": "https://ics-cert.us-cert.gov/advisories/icsa-15-237-02-supplement"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-81935"
      },
      {
        "db": "BID",
        "id": "76845"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004971"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-3974"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-565"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-81935"
      },
      {
        "db": "BID",
        "id": "76845"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004971"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-3974"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-565"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2015-09-28T00:00:00",
        "db": "VULHUB",
        "id": "VHN-81935"
      },
      {
        "date": "2015-09-24T00:00:00",
        "db": "BID",
        "id": "76845"
      },
      {
        "date": "2015-09-30T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2015-004971"
      },
      {
        "date": "2015-09-28T02:59:01.653000",
        "db": "NVD",
        "id": "CVE-2015-3974"
      },
      {
        "date": "2015-09-30T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201509-565"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2015-09-29T00:00:00",
        "db": "VULHUB",
        "id": "VHN-81935"
      },
      {
        "date": "2015-09-24T00:00:00",
        "db": "BID",
        "id": "76845"
      },
      {
        "date": "2015-09-30T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2015-004971"
      },
      {
        "date": "2015-09-29T19:23:04.207000",
        "db": "NVD",
        "id": "CVE-2015-3974"
      },
      {
        "date": "2015-10-09T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201509-565"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-565"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Used in products from multiple vendors  EasyIO EasyIO-30P-SF Vulnerabilities that can gain access rights in controller firmware",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-004971"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "trust management",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201509-565"
      }
    ],
    "trust": 0.6
  }
}

    VAR-201207-0104

    Vulnerability from variot - Updated: 2023-12-18 12:09

    Directory traversal vulnerability in Tridium Niagara AX Framework allows remote attackers to read files outside of the intended images, nav, and px folders by leveraging incorrect permissions, as demonstrated by reading the config.bog file. The Niagara Framework is a unified, open, distributed platform that integrates the management of a wide variety of devices and systems. The Niagara Framework has an input validation vulnerability that allows an attacker to exploit a vulnerability for a directory traversal attack. The vulnerability is due to the fact that some of the unspecified input is missing validation before being used to read the file, and any file content can be obtained by submitting a malicious request. TRIDIUM NiagaraAX is prone to a directory-traversal vulnerability. Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to retrieve arbitrary files in the context of the application. Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. ----------------------------------------------------------------------

    We are millions! Join us to protect all Pc's Worldwide. Download the new Secunia PSI 3.0 available in 5 languages and share it with your friends: http://secunia.com/psi

    TITLE: Niagara Framework Directory Traversal Vulnerability

    SECUNIA ADVISORY ID: SA49903

    VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/49903/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=49903

    RELEASE DATE: 2012-07-16

    DISCUSS ADVISORY: http://secunia.com/advisories/49903/#comments

    AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)

    http://secunia.com/advisories/49903/

    ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS

    https://ca.secunia.com/?page=viewadvisory&vuln_id=49903

    ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING

    http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/

    DESCRIPTION: A vulnerability has been reported in Niagara Framework, which can be exploited by malicious people to disclose system information. This can be exploited to disclose the contents of arbitrary files via directory traversal sequences.

    SOLUTION: The vendor recommends to limit access to the affected systems.

    PROVIDED AND/OR DISCOVERED BY: The vendor credits Billy Rios and Terry McCorkle via ICS-CERT.

    ORIGINAL ADVISORY: https://www.tridium.com/galleries/briefings/NiagaraAX_Framework_Software_Security_Alert.pdf

    OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

    DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

    EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

    EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

    EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

    About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.

    Subscribe: http://secunia.com/advisories/secunia_security_advisories/

    Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/

    Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.

    Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

    Show details on source website
    To clipboard 

    {
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201207-0104",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "niagara ax",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "tridium",
        "version": "*"
      },
      {
        "model": "niagara ax framework",
        "scope": null,
        "trust": 0.8,
        "vendor": "tridium",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.6,
        "vendor": "no",
        "version": null
      },
      {
        "model": "niagara framework",
        "scope": null,
        "trust": 0.6,
        "vendor": "tridium",
        "version": null
      },
      {
        "model": "niagra ax framework",
        "scope": null,
        "trust": 0.6,
        "vendor": "tridium",
        "version": null
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.4,
        "vendor": "niagra ax framework",
        "version": "*"
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "ac874866-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "IVD",
        "id": "f999f736-1f5f-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-8527"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-3707"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003104"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-4027"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-223"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:tridium:niagara_ax:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2012-4027"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Billy Rios and Terry McCorkle",
    "sources": [
      {
        "db": "BID",
        "id": "54454"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-241"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2012-4027",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 5.0,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "CVE-2012-4027",
            "impactScore": null,
            "integrityImpact": "None",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "NONE",
            "baseScore": 7.8,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2012-8527",
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "IVD",
            "availabilityImpact": "NONE",
            "baseScore": 7.8,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "ac874866-2353-11e6-abef-000c29c66e3d",
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "severity": "HIGH",
            "trust": 0.2,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
            "version": "2.9 [IVD]"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "IVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "f999f736-1f5f-11e6-abef-000c29c66e3d",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.2,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.9 [IVD]"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "VHN-57308",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2012-4027",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2012-8527",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201207-223",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "IVD",
            "id": "ac874866-2353-11e6-abef-000c29c66e3d",
            "trust": 0.2,
            "value": "MEDIUM"
          },
          {
            "author": "IVD",
            "id": "f999f736-1f5f-11e6-abef-000c29c66e3d",
            "trust": 0.2,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-57308",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "ac874866-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "IVD",
        "id": "f999f736-1f5f-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-8527"
      },
      {
        "db": "VULHUB",
        "id": "VHN-57308"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003104"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-4027"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-223"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Directory traversal vulnerability in Tridium Niagara AX Framework allows remote attackers to read files outside of the intended images, nav, and px folders by leveraging incorrect permissions, as demonstrated by reading the config.bog file. The Niagara Framework is a unified, open, distributed platform that integrates the management of a wide variety of devices and systems. The Niagara Framework has an input validation vulnerability that allows an attacker to exploit a vulnerability for a directory traversal attack. The vulnerability is due to the fact that some of the unspecified input is missing validation before being used to read the file, and any file content can be obtained by submitting a malicious request. TRIDIUM NiagaraAX is prone to a directory-traversal vulnerability. \nRemote attackers can use specially crafted requests with directory-traversal sequences (\u0027../\u0027) to retrieve arbitrary files in the context of the application. \nExploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. ----------------------------------------------------------------------\n\nWe are millions!  Join us to protect all Pc\u0027s Worldwide. \nDownload the new Secunia PSI 3.0 available in 5 languages and share it with your friends:\nhttp://secunia.com/psi\n\n----------------------------------------------------------------------\n\nTITLE:\nNiagara Framework Directory Traversal Vulnerability\n\nSECUNIA ADVISORY ID:\nSA49903\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/49903/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49903\n\nRELEASE DATE:\n2012-07-16\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/49903/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/49903/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49903\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nA vulnerability has been reported in Niagara Framework, which can be\nexploited by malicious people to disclose system information. This can be exploited to disclose the contents of\narbitrary files via directory traversal sequences. \n\nSOLUTION:\nThe vendor recommends to limit access to the affected systems. \n\nPROVIDED AND/OR DISCOVERED BY:\nThe vendor credits Billy Rios and Terry McCorkle via ICS-CERT. \n\nORIGINAL ADVISORY:\nhttps://www.tridium.com/galleries/briefings/NiagaraAX_Framework_Software_Security_Alert.pdf\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2012-4027"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003104"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-8527"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-3707"
      },
      {
        "db": "BID",
        "id": "54454"
      },
      {
        "db": "IVD",
        "id": "ac874866-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "IVD",
        "id": "f999f736-1f5f-11e6-abef-000c29c66e3d"
      },
      {
        "db": "VULHUB",
        "id": "VHN-57308"
      },
      {
        "db": "PACKETSTORM",
        "id": "114789"
      }
    ],
    "trust": 3.51
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2012-4027",
        "trust": 3.9
      },
      {
        "db": "BID",
        "id": "54454",
        "trust": 1.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-223",
        "trust": 1.1
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-8527",
        "trust": 0.8
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-3707",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003104",
        "trust": 0.8
      },
      {
        "db": "SECUNIA",
        "id": "49903",
        "trust": 0.7
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-241",
        "trust": 0.6
      },
      {
        "db": "IVD",
        "id": "AC874866-2353-11E6-ABEF-000C29C66E3D",
        "trust": 0.2
      },
      {
        "db": "IVD",
        "id": "F999F736-1F5F-11E6-ABEF-000C29C66E3D",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "115639",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-57308",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "114789",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "ac874866-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "IVD",
        "id": "f999f736-1f5f-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-8527"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-3707"
      },
      {
        "db": "VULHUB",
        "id": "VHN-57308"
      },
      {
        "db": "BID",
        "id": "54454"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003104"
      },
      {
        "db": "PACKETSTORM",
        "id": "114789"
      },
      {
        "db": "PACKETSTORM",
        "id": "115639"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-4027"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-241"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-223"
      }
    ]
  },
  "id": "VAR-201207-0104",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "ac874866-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "IVD",
        "id": "f999f736-1f5f-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-8527"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-3707"
      },
      {
        "db": "VULHUB",
        "id": "VHN-57308"
      }
    ],
    "trust": 2.46729304
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 1.6
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "ac874866-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "IVD",
        "id": "f999f736-1f5f-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-8527"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-3707"
      }
    ]
  },
  "last_update_date": "2023-12-18T12:09:48.423000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Security Alert: Niagara AX(tm) Directory Traversal Remediation",
        "trust": 0.8,
        "url": "https://www.tridium.com/galleries/briefings/niagaraax_framework_software_security_alert.pdf"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003104"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-22",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-264",
        "trust": 0.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-57308"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003104"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-4027"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.8,
        "url": "https://www.tridium.com/galleries/briefings/niagaraax_framework_software_security_alert.pdf"
      },
      {
        "trust": 1.7,
        "url": "http://www.washingtonpost.com/investigations/tridiums-niagara-framework-marvel-of-connectivity-illustrates-new-cyber-risks/2012/07/11/gjqarjl6dw_story.html"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-4027"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-4027"
      },
      {
        "trust": 0.6,
        "url": "http://web.nvd.nist.gov/view/vuln/search-results?query=cve-2012-4027"
      },
      {
        "trust": 0.6,
        "url": "http://secunia.com/advisories/49903/https"
      },
      {
        "trust": 0.6,
        "url": "http://www.securityfocus.com/bid/54454"
      },
      {
        "trust": 0.1,
        "url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49903"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/psi"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/vulnerability_intelligence/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/secunia_security_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/49903/#comments"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/vulnerability_scanning/personal/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/49903/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/about_secunia_advisories/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-4028"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-3025"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-3024"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-4027"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2012-8527"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-3707"
      },
      {
        "db": "VULHUB",
        "id": "VHN-57308"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003104"
      },
      {
        "db": "PACKETSTORM",
        "id": "114789"
      },
      {
        "db": "PACKETSTORM",
        "id": "115639"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-4027"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-241"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-223"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "IVD",
        "id": "ac874866-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "IVD",
        "id": "f999f736-1f5f-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-8527"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-3707"
      },
      {
        "db": "VULHUB",
        "id": "VHN-57308"
      },
      {
        "db": "BID",
        "id": "54454"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003104"
      },
      {
        "db": "PACKETSTORM",
        "id": "114789"
      },
      {
        "db": "PACKETSTORM",
        "id": "115639"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-4027"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-241"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-223"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2012-07-17T00:00:00",
        "db": "IVD",
        "id": "ac874866-2353-11e6-abef-000c29c66e3d"
      },
      {
        "date": "2012-07-18T00:00:00",
        "db": "IVD",
        "id": "f999f736-1f5f-11e6-abef-000c29c66e3d"
      },
      {
        "date": "2012-07-17T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2012-8527"
      },
      {
        "date": "2012-07-18T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2012-3707"
      },
      {
        "date": "2012-07-16T00:00:00",
        "db": "VULHUB",
        "id": "VHN-57308"
      },
      {
        "date": "2012-07-13T00:00:00",
        "db": "BID",
        "id": "54454"
      },
      {
        "date": "2012-07-18T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2012-003104"
      },
      {
        "date": "2012-07-17T01:30:18",
        "db": "PACKETSTORM",
        "id": "114789"
      },
      {
        "date": "2012-08-17T03:33:48",
        "db": "PACKETSTORM",
        "id": "115639"
      },
      {
        "date": "2012-07-16T20:55:04.957000",
        "db": "NVD",
        "id": "CVE-2012-4027"
      },
      {
        "date": "2012-07-18T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201207-241"
      },
      {
        "date": "2012-07-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201207-223"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2012-07-17T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2012-8527"
      },
      {
        "date": "2012-07-18T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2012-3707"
      },
      {
        "date": "2012-07-17T00:00:00",
        "db": "VULHUB",
        "id": "VHN-57308"
      },
      {
        "date": "2013-08-13T07:26:00",
        "db": "BID",
        "id": "54454"
      },
      {
        "date": "2012-07-18T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2012-003104"
      },
      {
        "date": "2023-03-22T14:09:05.423000",
        "db": "NVD",
        "id": "CVE-2012-4027"
      },
      {
        "date": "2012-07-18T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201207-241"
      },
      {
        "date": "2023-03-23T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201207-223"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-241"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-223"
      }
    ],
    "trust": 1.2
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Tridium Niagara AX Framework Directory Traversal Vulnerability",
    "sources": [
      {
        "db": "IVD",
        "id": "ac874866-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-8527"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-223"
      }
    ],
    "trust": 1.4
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "path traversal",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-241"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-223"
      }
    ],
    "trust": 1.2
  }
}

    VAR-201208-0352

    Vulnerability from variot - Updated: 2023-12-18 12:09

    The default configuration of Tridium Niagara AX Framework through 3.6 uses a cleartext base64 format for transmission of credentials in cookies, which allows remote attackers to obtain sensitive information by sniffing the network. A remote attacker can exploit this vulnerability to gain sensitive information by sniffing the network. Tridium Niagara AX Framework is prone to an information-disclosure vulnerability. This may lead to further attacks. ----------------------------------------------------------------------

    The new Secunia CSI 6.0 is now available in beta! Seamless integration with your existing security solutions Sign-up to become a Beta tester: http://secunia.com/csi6beta

    TITLE: Niagara Framework Predictable Session Identifier Vulnerability

    SECUNIA ADVISORY ID: SA50288

    VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/50288/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=50288

    RELEASE DATE: 2012-08-16

    DISCUSS ADVISORY: http://secunia.com/advisories/50288/#comments

    AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)

    http://secunia.com/advisories/50288/

    ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS

    https://ca.secunia.com/?page=viewadvisory&vuln_id=50288

    ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING

    http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/

    DESCRIPTION: A vulnerability has been reported in Niagara Framework, which can be exploited by malicious people to hijack a user's session.

    The vulnerability is caused due to predictable sessions identifiers being used.

    SOLUTION: No official solution is currently available.

    PROVIDED AND/OR DISCOVERED BY: Billy Rios and Terry McCorkle via ICS-CERT.

    ORIGINAL ADVISORY: ICS-CERT: http://www.us-cert.gov/control_systems/pdf/ICSA-12-228-01.pdf

    OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

    DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

    EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

    EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

    EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

    About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.

    Subscribe: http://secunia.com/advisories/secunia_security_advisories/

    Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/

    Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.

    Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

    Show details on source website
    To clipboard 

    {
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201208-0352",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "niagara ax",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "tridium",
        "version": "3.6"
      },
      {
        "model": "niagara ax framework",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "tridium",
        "version": "3.6"
      },
      {
        "model": "niagara ax",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "tridium",
        "version": "3.5/3.6/3.7"
      },
      {
        "model": "niagra ax framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "tridium",
        "version": "3.5"
      },
      {
        "model": "niagra ax framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "tridium",
        "version": "3.6"
      },
      {
        "model": "niagaraax",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "tridium",
        "version": "3.6"
      },
      {
        "model": "niagaraax",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "tridium",
        "version": "0"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "niagra ax framework",
        "version": "3.5"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "niagra ax framework",
        "version": "*"
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "80dad020-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-8346"
      },
      {
        "db": "BID",
        "id": "61741"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003722"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-3025"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201208-277"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:tridium:niagara_ax:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "3.6",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2012-3025"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Billy Rios and Terry McCorkle",
    "sources": [
      {
        "db": "BID",
        "id": "61741"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2012-3025",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 5.0,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "CVE-2012-3025",
            "impactScore": null,
            "integrityImpact": "None",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2012-8346",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "IVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "80dad020-2353-11e6-abef-000c29c66e3d",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.2,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.9 [IVD]"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "VHN-56306",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2012-3025",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2012-8346",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201208-277",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "IVD",
            "id": "80dad020-2353-11e6-abef-000c29c66e3d",
            "trust": 0.2,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-56306",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "80dad020-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-8346"
      },
      {
        "db": "VULHUB",
        "id": "VHN-56306"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003722"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-3025"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201208-277"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The default configuration of Tridium Niagara AX Framework through 3.6 uses a cleartext base64 format for transmission of credentials in cookies, which allows remote attackers to obtain sensitive information by sniffing the network. A remote attacker can exploit this vulnerability to gain sensitive information by sniffing the network. Tridium Niagara AX Framework is prone to an information-disclosure vulnerability. This may lead to further attacks. ----------------------------------------------------------------------\n\nThe new Secunia CSI 6.0 is now available in beta!\nSeamless integration with your existing security solutions Sign-up to \nbecome a Beta tester: http://secunia.com/csi6beta\n\n----------------------------------------------------------------------\n\nTITLE:\nNiagara Framework Predictable Session Identifier Vulnerability\n\nSECUNIA ADVISORY ID:\nSA50288\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/50288/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=50288\n\nRELEASE DATE:\n2012-08-16\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/50288/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/50288/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=50288\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nA vulnerability has been reported in Niagara Framework, which can be\nexploited by malicious people to hijack a user\u0027s session. \n\nThe vulnerability is caused due to predictable sessions identifiers\nbeing used. \n\nSOLUTION:\nNo official solution is currently available. \n\nPROVIDED AND/OR DISCOVERED BY:\nBilly Rios and Terry McCorkle via ICS-CERT. \n\nORIGINAL ADVISORY:\nICS-CERT:\nhttp://www.us-cert.gov/control_systems/pdf/ICSA-12-228-01.pdf\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2012-3025"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003722"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-8346"
      },
      {
        "db": "BID",
        "id": "61741"
      },
      {
        "db": "IVD",
        "id": "80dad020-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "VULHUB",
        "id": "VHN-56306"
      },
      {
        "db": "PACKETSTORM",
        "id": "115613"
      }
    ],
    "trust": 2.79
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2012-3025",
        "trust": 3.7
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-12-228-01",
        "trust": 3.5
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201208-277",
        "trust": 0.9
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-8346",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003722",
        "trust": 0.8
      },
      {
        "db": "BID",
        "id": "61741",
        "trust": 0.4
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-12-228-01A",
        "trust": 0.3
      },
      {
        "db": "IVD",
        "id": "80DAD020-2353-11E6-ABEF-000C29C66E3D",
        "trust": 0.2
      },
      {
        "db": "SECUNIA",
        "id": "50288",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-56306",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "115639",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "115613",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "80dad020-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-8346"
      },
      {
        "db": "VULHUB",
        "id": "VHN-56306"
      },
      {
        "db": "BID",
        "id": "61741"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003722"
      },
      {
        "db": "PACKETSTORM",
        "id": "115639"
      },
      {
        "db": "PACKETSTORM",
        "id": "115613"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-3025"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201208-277"
      }
    ]
  },
  "id": "VAR-201208-0352",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "80dad020-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-8346"
      },
      {
        "db": "VULHUB",
        "id": "VHN-56306"
      }
    ],
    "trust": 1.55093956
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "80dad020-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-8346"
      }
    ]
  },
  "last_update_date": "2023-12-18T12:09:48.378000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Security Update: Niagara AX 3.5 and 3.6 Security Patches",
        "trust": 0.8,
        "url": "http://www.tridium.com/cs/tridium_news/security_patch_36"
      },
      {
        "title": "Tridium Niagara AX Framework Patch for Encryption Vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/35531"
      },
      {
        "title": "framework-3.6.0",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=44160"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2012-8346"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003722"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201208-277"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-522",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-310",
        "trust": 0.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-56306"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003722"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-3025"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.2,
        "url": "http://www.us-cert.gov/control_systems/pdf/icsa-12-228-01.pdf"
      },
      {
        "trust": 1.7,
        "url": "http://www.tridium.com/cs/tridium_news/security_patch_36"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-3025"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-3025"
      },
      {
        "trust": 0.3,
        "url": "http://ics-cert.us-cert.gov/advisories/icsa-12-228-01"
      },
      {
        "trust": 0.3,
        "url": "http://ics-cert.us-cert.gov/advisories/icsa-12-228-01a"
      },
      {
        "trust": 0.3,
        "url": "http://www.tridium.com/cs/products_/_services/niagaraax"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-4028"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-3025"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-3024"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-4027"
      },
      {
        "trust": 0.1,
        "url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=50288"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/vulnerability_intelligence/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/secunia_security_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/50288/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/csi6beta"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/vulnerability_scanning/personal/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/50288/#comments"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/about_secunia_advisories/"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2012-8346"
      },
      {
        "db": "VULHUB",
        "id": "VHN-56306"
      },
      {
        "db": "BID",
        "id": "61741"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003722"
      },
      {
        "db": "PACKETSTORM",
        "id": "115639"
      },
      {
        "db": "PACKETSTORM",
        "id": "115613"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-3025"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201208-277"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "IVD",
        "id": "80dad020-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-8346"
      },
      {
        "db": "VULHUB",
        "id": "VHN-56306"
      },
      {
        "db": "BID",
        "id": "61741"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003722"
      },
      {
        "db": "PACKETSTORM",
        "id": "115639"
      },
      {
        "db": "PACKETSTORM",
        "id": "115613"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-3025"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201208-277"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2012-08-20T00:00:00",
        "db": "IVD",
        "id": "80dad020-2353-11e6-abef-000c29c66e3d"
      },
      {
        "date": "2012-08-20T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2012-8346"
      },
      {
        "date": "2012-08-16T00:00:00",
        "db": "VULHUB",
        "id": "VHN-56306"
      },
      {
        "date": "2012-08-15T00:00:00",
        "db": "BID",
        "id": "61741"
      },
      {
        "date": "2012-08-20T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2012-003722"
      },
      {
        "date": "2012-08-17T03:33:48",
        "db": "PACKETSTORM",
        "id": "115639"
      },
      {
        "date": "2012-08-16T06:34:56",
        "db": "PACKETSTORM",
        "id": "115613"
      },
      {
        "date": "2012-08-16T10:38:04.750000",
        "db": "NVD",
        "id": "CVE-2012-3025"
      },
      {
        "date": "2012-08-20T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201208-277"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2012-08-20T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2012-8346"
      },
      {
        "date": "2012-08-16T00:00:00",
        "db": "VULHUB",
        "id": "VHN-56306"
      },
      {
        "date": "2012-08-15T00:00:00",
        "db": "BID",
        "id": "61741"
      },
      {
        "date": "2012-08-20T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2012-003722"
      },
      {
        "date": "2023-03-22T14:09:30.673000",
        "db": "NVD",
        "id": "CVE-2012-3025"
      },
      {
        "date": "2023-03-23T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201208-277"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201208-277"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Tridium Niagara AX Framework Vulnerability in which important information is obtained in default settings",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003722"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "encryption problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201208-277"
      }
    ],
    "trust": 0.6
  }
}

    VAR-201208-0351

    Vulnerability from variot - Updated: 2023-12-18 12:09

    Tridium Niagara AX Framework through 3.6 uses predictable values for (1) session IDs and (2) keys, which might allow remote attackers to bypass authentication via a brute-force attack. Niagara Framework is prone to a session-hijacking vulnerability. Successful exploit of this issue allows an attacker to gain unauthorized access to the affected application. ----------------------------------------------------------------------

    The new Secunia CSI 6.0 is now available in beta! Seamless integration with your existing security solutions Sign-up to become a Beta tester: http://secunia.com/csi6beta

    TITLE: Niagara Framework Predictable Session Identifier Vulnerability

    SECUNIA ADVISORY ID: SA50288

    VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/50288/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=50288

    RELEASE DATE: 2012-08-16

    DISCUSS ADVISORY: http://secunia.com/advisories/50288/#comments

    AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)

    http://secunia.com/advisories/50288/

    ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS

    https://ca.secunia.com/?page=viewadvisory&vuln_id=50288

    ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING

    http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/

    DESCRIPTION: A vulnerability has been reported in Niagara Framework, which can be exploited by malicious people to hijack a user's session.

    The vulnerability is caused due to predictable sessions identifiers being used.

    SOLUTION: No official solution is currently available.

    PROVIDED AND/OR DISCOVERED BY: Billy Rios and Terry McCorkle via ICS-CERT.

    ORIGINAL ADVISORY: ICS-CERT: http://www.us-cert.gov/control_systems/pdf/ICSA-12-228-01.pdf

    OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

    DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

    EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

    EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

    EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

    About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.

    Subscribe: http://secunia.com/advisories/secunia_security_advisories/

    Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/

    Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.

    Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

    Show details on source website
    To clipboard 

    {
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201208-0351",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "niagara ax",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "tridium",
        "version": "3.6"
      },
      {
        "model": "niagara ax framework",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "tridium",
        "version": "3.6"
      },
      {
        "model": "niagara ax",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "tridium",
        "version": "3.5/3.6/3.7"
      },
      {
        "model": "niagra ax framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "tridium",
        "version": "3.5"
      },
      {
        "model": "niagra ax framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "tridium",
        "version": "3.6"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "niagra ax framework",
        "version": "3.5"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "niagra ax framework",
        "version": "*"
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "80e047f8-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-8347"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003721"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-3024"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201208-276"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:tridium:niagara_ax:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "3.6",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2012-3024"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Billy Rios and Terry McCorkle",
    "sources": [
      {
        "db": "BID",
        "id": "55042"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2012-3024",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 5.0,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2012-3024",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2012-8347",
            "impactScore": 4.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "IVD",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "80e047f8-2353-11e6-abef-000c29c66e3d",
            "impactScore": 4.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.2,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.9 [IVD]"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "VHN-56305",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2012-3024",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2012-8347",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201208-276",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "IVD",
            "id": "80e047f8-2353-11e6-abef-000c29c66e3d",
            "trust": 0.2,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-56305",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "80e047f8-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-8347"
      },
      {
        "db": "VULHUB",
        "id": "VHN-56305"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003721"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-3024"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201208-276"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Tridium Niagara AX Framework through 3.6 uses predictable values for (1) session IDs and (2) keys, which might allow remote attackers to bypass authentication via a brute-force attack. Niagara Framework is prone to a session-hijacking vulnerability. \nSuccessful exploit of this issue allows an attacker to gain unauthorized access to the affected application. ----------------------------------------------------------------------\n\nThe new Secunia CSI 6.0 is now available in beta!\nSeamless integration with your existing security solutions Sign-up to \nbecome a Beta tester: http://secunia.com/csi6beta\n\n----------------------------------------------------------------------\n\nTITLE:\nNiagara Framework Predictable Session Identifier Vulnerability\n\nSECUNIA ADVISORY ID:\nSA50288\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/50288/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=50288\n\nRELEASE DATE:\n2012-08-16\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/50288/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/50288/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=50288\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nA vulnerability has been reported in Niagara Framework, which can be\nexploited by malicious people to hijack a user\u0027s session. \n\nThe vulnerability is caused due to predictable sessions identifiers\nbeing used. \n\nSOLUTION:\nNo official solution is currently available. \n\nPROVIDED AND/OR DISCOVERED BY:\nBilly Rios and Terry McCorkle via ICS-CERT. \n\nORIGINAL ADVISORY:\nICS-CERT:\nhttp://www.us-cert.gov/control_systems/pdf/ICSA-12-228-01.pdf\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2012-3024"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003721"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-8347"
      },
      {
        "db": "BID",
        "id": "55042"
      },
      {
        "db": "IVD",
        "id": "80e047f8-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "VULHUB",
        "id": "VHN-56305"
      },
      {
        "db": "PACKETSTORM",
        "id": "115613"
      }
    ],
    "trust": 2.79
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2012-3024",
        "trust": 3.7
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-12-228-01",
        "trust": 3.2
      },
      {
        "db": "BID",
        "id": "55042",
        "trust": 1.0
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201208-276",
        "trust": 0.9
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-8347",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003721",
        "trust": 0.8
      },
      {
        "db": "IVD",
        "id": "80E047F8-2353-11E6-ABEF-000C29C66E3D",
        "trust": 0.2
      },
      {
        "db": "SECUNIA",
        "id": "50288",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-56305",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "115639",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "115613",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "80e047f8-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-8347"
      },
      {
        "db": "VULHUB",
        "id": "VHN-56305"
      },
      {
        "db": "BID",
        "id": "55042"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003721"
      },
      {
        "db": "PACKETSTORM",
        "id": "115639"
      },
      {
        "db": "PACKETSTORM",
        "id": "115613"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-3024"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201208-276"
      }
    ]
  },
  "id": "VAR-201208-0351",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "80e047f8-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-8347"
      },
      {
        "db": "VULHUB",
        "id": "VHN-56305"
      }
    ],
    "trust": 1.55093956
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "80e047f8-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-8347"
      }
    ]
  },
  "last_update_date": "2023-12-18T12:09:48.333000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Security Update: Niagara AX 3.5 and 3.6 Security Patches",
        "trust": 0.8,
        "url": "http://www.tridium.com/cs/tridium_news/security_patch_36"
      },
      {
        "title": "Patch for the Tridium Niagara AX Framework Licensing Issue Vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/35532"
      },
      {
        "title": "framework-3.6.0",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=44160"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2012-8347"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003721"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201208-276"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-287",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-56305"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003721"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-3024"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.2,
        "url": "http://www.us-cert.gov/control_systems/pdf/icsa-12-228-01.pdf"
      },
      {
        "trust": 1.7,
        "url": "http://www.tridium.com/cs/tridium_news/security_patch_36"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-3024"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-3024"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-4028"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-3025"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-3024"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-4027"
      },
      {
        "trust": 0.1,
        "url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=50288"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/vulnerability_intelligence/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/secunia_security_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/50288/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/csi6beta"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/vulnerability_scanning/personal/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/50288/#comments"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/about_secunia_advisories/"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2012-8347"
      },
      {
        "db": "VULHUB",
        "id": "VHN-56305"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003721"
      },
      {
        "db": "PACKETSTORM",
        "id": "115639"
      },
      {
        "db": "PACKETSTORM",
        "id": "115613"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-3024"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201208-276"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "IVD",
        "id": "80e047f8-2353-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-8347"
      },
      {
        "db": "VULHUB",
        "id": "VHN-56305"
      },
      {
        "db": "BID",
        "id": "55042"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003721"
      },
      {
        "db": "PACKETSTORM",
        "id": "115639"
      },
      {
        "db": "PACKETSTORM",
        "id": "115613"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-3024"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201208-276"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2012-08-20T00:00:00",
        "db": "IVD",
        "id": "80e047f8-2353-11e6-abef-000c29c66e3d"
      },
      {
        "date": "2012-08-20T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2012-8347"
      },
      {
        "date": "2012-08-16T00:00:00",
        "db": "VULHUB",
        "id": "VHN-56305"
      },
      {
        "date": "2012-08-16T00:00:00",
        "db": "BID",
        "id": "55042"
      },
      {
        "date": "2012-08-20T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2012-003721"
      },
      {
        "date": "2012-08-17T03:33:48",
        "db": "PACKETSTORM",
        "id": "115639"
      },
      {
        "date": "2012-08-16T06:34:56",
        "db": "PACKETSTORM",
        "id": "115613"
      },
      {
        "date": "2012-08-16T10:38:04.593000",
        "db": "NVD",
        "id": "CVE-2012-3024"
      },
      {
        "date": "2012-08-20T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201208-276"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2012-08-20T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2012-8347"
      },
      {
        "date": "2012-08-16T00:00:00",
        "db": "VULHUB",
        "id": "VHN-56305"
      },
      {
        "date": "2013-08-13T05:26:00",
        "db": "BID",
        "id": "55042"
      },
      {
        "date": "2012-08-20T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2012-003721"
      },
      {
        "date": "2023-03-22T14:08:50.977000",
        "db": "NVD",
        "id": "CVE-2012-3024"
      },
      {
        "date": "2023-03-23T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201208-276"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201208-276"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Tridium Niagara AX Framework Vulnerabilities that bypass authentication",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003721"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "authorization issue",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201208-276"
      }
    ],
    "trust": 0.6
  }
}