{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-3943", "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "state": "PUBLISHED", "assignerShortName": "Honeywell", "dateReserved": "2025-04-25T15:21:19.481Z", "datePublished": "2025-05-22T12:42:13.893Z", "dateUpdated": "2025-05-22T13:19:08.477Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "platforms": ["Windows", "Linux", "QNX"], "product": "Niagara Framework", "vendor": "Tridium", "versions": [{"lessThan": "4.14.2", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "4.15.1", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "4.10.11", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "affected", "platforms": ["Windows", "Linux", "QNX"], "product": "Niagara Enterprise Security", "vendor": "Tridium", "versions": [{"lessThan": "4.14.2", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "4.15.1", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "4.10.11", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Andrea Palanca and team at Nozomi Network"}], "datePublic": "2025-05-08T16:59:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Parameter Injection. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.&nbsp;Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.<br><br>"}], "value": "Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Parameter Injection. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."}], "impacts": [{"capecId": "CAPEC-137", "descriptions": [{"lang": "en", "value": "CAPEC-137 Parameter Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-598", "description": "CWE-598 Use of GET Request Method With Sensitive Query Strings", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "shortName": "Honeywell", "dateUpdated": "2025-05-22T12:42:13.893Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://honeywell.com/us/en/product-security#security-notices"}, {"tags": ["vendor-advisory"], "url": "https://docs.niagara-community.com/category/tech_bull"}], "source": {"discovery": "UNKNOWN"}, "title": "Use of GET Request Method With sensitive Query Strings", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-22T13:19:00.551594Z", "id": "CVE-2025-3943", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-22T13:19:08.477Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3943", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-22T13:19:00.551594Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-22T13:19:03.634Z"}}], "cna": {"title": "Use of GET Request Method With sensitive Query Strings", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Andrea Palanca and team at Nozomi Network"}], "impacts": [{"capecId": "CAPEC-137", "descriptions": [{"lang": "en", "value": "CAPEC-137 Parameter Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Tridium", "product": "Niagara Framework", "versions": [{"status": "affected", "version": "0", "lessThan": "4.14.2", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "4.15.1", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "4.10.11", "versionType": "custom"}], "platforms": ["Windows", "Linux", "QNX"], "defaultStatus": "affected"}, {"vendor": "Tridium", "product": "Niagara Enterprise Security", "versions": [{"status": "affected", "version": "0", "lessThan": "4.14.2", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "4.15.1", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "4.10.11", "versionType": "custom"}], "platforms": ["Windows", "Linux", "QNX"], "defaultStatus": "affected"}], "datePublic": "2025-05-08T16:59:00.000Z", "references": [{"url": "https://honeywell.com/us/en/product-security#security-notices", "tags": ["vendor-advisory"]}, {"url": "https://docs.niagara-community.com/category/tech_bull", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Parameter Injection. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.", "supportingMedia": [{"type": "text/html", "value": "Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Parameter Injection. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.&nbsp;Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.<br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-598", "description": "CWE-598 Use of GET Request Method With Sensitive Query Strings"}]}], "providerMetadata": {"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "shortName": "Honeywell", "dateUpdated": "2025-05-22T12:42:13.893Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3943", "state": "PUBLISHED", "dateUpdated": "2025-05-22T13:19:08.477Z", "dateReserved": "2025-04-25T15:21:19.481Z", "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "datePublished": "2025-05-22T12:42:13.893Z", "assignerShortName": "Honeywell"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tridium:niagara:4.10u10:*:*:*:*:*:*:*", "matchCriteriaId": "0615B9FA-E837-4C21-8968-F3273718DF7D", "vulnerable": true}, {"criteria": "cpe:2.3:a:tridium:niagara:4.14u1:*:*:*:*:*:*:*", "matchCriteriaId": "BEE26A6F-876E-450D-8A5F-EF4A3EF96A13", "vulnerable": true}, {"criteria": "cpe:2.3:a:tridium:niagara:4.15:*:*:*:*:*:*:*", "matchCriteriaId": "00C6667A-9873-4A75-AB11-3427AA1E552D", "vulnerable": true}, {"criteria": "cpe:2.3:a:tridium:niagara_enterprise_security:4.10u10:*:*:*:*:*:*:*", "matchCriteriaId": "E694C4DB-66F7-4753-81D8-9085B5E3A207", "vulnerable": true}, {"criteria": "cpe:2.3:a:tridium:niagara_enterprise_security:4.14u1:*:*:*:*:*:*:*", "matchCriteriaId": "506E75F5-D259-4BAC-9C1A-83C9AD54D608", "vulnerable": true}, {"criteria": "cpe:2.3:a:tridium:niagara_enterprise_security:4.15:*:*:*:*:*:*:*", "matchCriteriaId": "6DF70636-5B89-4646-80F3-83C906B0EB3C", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:blackberry:qnx:-:*:*:*:*:*:*:*", "matchCriteriaId": "3642981A-848E-4DEA-A904-A83B9ED4891D", "vulnerable": false}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Parameter Injection. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."}, {"lang": "es", "value": "Vulnerabilidad en el uso del m\u00e9todo de solicitud GET con cadenas de consulta sensibles en Tridium Niagara Framework para Windows, Linux y QNX, Tridium Niagara Enterprise Security para Windows, Linux y QNX permite la inyecci\u00f3n de par\u00e1metros. Este problema afecta a Niagara Framework: versiones anteriores a la 4.14.2, 4.15.1 y 4.10.11; y Niagara Enterprise Security: versiones anteriores a la 4.14.2, 4.15.1 y 4.10.11. Tridium recomienda actualizar a las versiones 4.14.2u2, 4.15.u1 o 4.10u.11 de Niagara Framework y Enterprise Security."}], "id": "CVE-2025-3943", "lastModified": "2025-06-04T19:27:46.100", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 1.4, "source": "psirt@honeywell.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-05-22T13:15:57.257", "references": [{"source": "psirt@honeywell.com", "tags": ["Permissions Required"], "url": "https://docs.niagara-community.com/category/tech_bull"}, {"source": "psirt@honeywell.com", "tags": ["Vendor Advisory"], "url": "https://honeywell.com/us/en/product-security#security-notices"}], "sourceIdentifier": "psirt@honeywell.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-598"}], "source": "psirt@honeywell.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}