CVE-2025-3943
medium · 4.1Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Parameter Injection. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
4.1
CVSS
10.2%
EPSS (exploit prob.)
96th
EPSS percentile
2025-05-22
Published
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Weaknesses
CWE-598
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| tridium | niagara | 4.10u10 |
| tridium | niagara | 4.14u1 |
| tridium | niagara | 4.15 |
| tridium | niagara_enterprise_security | 4.10u10 |
| tridium | niagara_enterprise_security | 4.14u1 |
| tridium | niagara_enterprise_security | 4.15 |
| blackberry | qnx | all versions |
| linux | linux_kernel | all versions |
| microsoft | windows | all versions |
Check a specific version with /api/v1/cve/match.
References
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2025-3943