CVE-2025-3941: tridium niagara
Vulnerability summary
CVE-2025-3941 is a critical (CVSS 9.8) vulnerability in tridium niagara. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.9% of scored vulnerabilities.
Timeline
- 22-05-2025PublishedVulnerability first disclosed.
- 22-05-2025Last modifiedVulnerability information updated.
Description
Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.50%
Chance of exploitation in the next 30 days
Percentile
42%
Versus all other CVEs
30-day change
-0.01 pp
From 0.52% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-69Improper Handling of Windows ::DATA Alternate Data StreamThe product does not properly prevent access to, or detect usage of, alternate data streams (ADS).
- CWE-706Use of Incorrectly-Resolved Name or ReferenceThe product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
Affected systems
Tridium3 products
- niagara4.10u10 | 4.14u1 | 4.15
- niagara_enterprise_security< 4.14.2 | < 4.15.1 | < 4.10.11 | 4.10u10 | 4.14u1 | 4.15
- niagara framework< 4.14.2 | < 4.15.1 | < 4.10.11
1 vendor · 3 products
References
2 links- www.honeywell.com/us/en/product-securityVendor Advisory