The vulnerabilities, affecting versions 4.10u10 and earlier, as well as 4.14u1 and earlier, enable attackers with network access to execute sophisticated attack chains resulting in complete system compromise, including root-level remote code execution on target devices. According to Nozomi Networks Labs, Tridium Niagara Framework serves as a critical middleware platform connecting diverse IoT devices across building management, industrial automation, and smart infrastructure environments. These flaws become fully exploitable when Niagara systems are misconfigured with disabled encryption on network devices, a configuration that generates security dashboard warnings. Critical flaws discovered in Tridium Niagara Framework affecting building automation systems. The attack prerequisites include Man-in-the-Middle (MiTM) network positioning and misconfigured Syslog functionality transmitting data without encryption. The newly discovered vulnerabilities are consolidated into ten distinct CVEs, with CVE-2025-3937 scoring the highest CVSS v3.1 rating of 7.7 due to insufficient computational effort in password hashing (CWE-916).
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 25 Jul 2025 13:40:13 +0000