Researchers identified 13 critical vulnerabilities in Tridium’s widely-deployed Niagara Framework that could allow attackers to compromise building automation systems and collect sensitive network data.
The vulnerabilities, affecting versions 4.10u10 and earlier, as well as 4.14u1 and earlier, enable attackers with network access to execute sophisticated attack chains resulting in complete system compromise, including root-level remote code execution on target devices.
Key Takeaways1. Critical flaws discovered in Tridium Niagara Framework affecting building automation systems.2. Attackers can achieve complete device compromise when encryption is disabled.3. Updates required to protect critical infrastructure.
Critical Framework Vulnerabilities
According to Nozomi Networks Labs, Tridium Niagara Framework serves as a critical middleware platform connecting diverse IoT devices across building management, industrial automation, and smart infrastructure environments.
Niagara Workbench main interface
The newly discovered vulnerabilities are consolidated into ten distinct CVEs, with CVE-2025-3937 scoring the highest CVSS v3.1 rating of 7.7 due to insufficient computational effort in password hashing (CWE-916).
The most severe vulnerabilities include CVE-2025-3944 with a CVSS score of 7.2, involving incorrect permission assignment for critical resources, and CVE-2025-3945, also scoring 7.2, which enables argument injection attacks.
These flaws become fully exploitable when Niagara systems are misconfigured with disabled encryption on network devices, a configuration that generates security dashboard warnings.
Researchers identified an attack chain leveraging CVE-2025-3943 and CVE-2025-3944 that enables adjacent attackers to achieve complete system compromise.
The attack begins with intercepting anti-CSRF refresh tokens transmitted through GET requests to the /ord endpoint:
Attacker interacts with the Niagara station
The vulnerability chain allows attackers to extract JSESSIONID session tokens from unencrypted Syslog traffic, escalate privileges, and ultimately exploit CVE-2025-3944 to execute arbitrary code through dhcpd.conf hooks.
The following proof-of-concept demonstrates root-level code execution:
CVE IDTitleCVSS 3.1 ScoreSeverityCVE-2025-3937Use of Password Hash with Insufficient Computational Effort7.7HighCVE-2025-3944Incorrect Permission Assignment for Critical Resource7.2HighCVE-2025-3945Argument Injection7.2HighCVE-2025-3938Missing Cryptographic Step6.8MediumCVE-2025-3936Incorrect Permission Assignment for Critical Resource6.5MediumCVE-2025-3941Improper Handling of Windows DATA Alternate Data Stream5.4MediumCVE-2025-3939Observable Response Discrepancy5.3MediumCVE-2025-3940Improper Use of Validation Framework5.3MediumCVE-2025-3942Improper Output Neutralization for Logs4.3MediumCVE-2025-3943Use of GET Request Method with Sensitive Query Strings4.1Medium
Mitigations
Tridium has responded swiftly by issuing security patches and publishing a comprehensive security advisory addressing all identified vulnerabilities.
The attack prerequisites include Man-in-the-Middle (MiTM) network positioning and misconfigured Syslog functionality transmitting data without encryption.
Organizations operating Niagara-powered systems must immediately update to patched versions and implement network segmentation to limit exposure.
The vulnerabilities pose significant risks to operational technology environments, potentially enabling lateral movement through T1210 – Exploitation of Remote Services and operational disruptions via T1499 – Endpoint Denial of Service attack techniques.
Given Niagara’s deployment across critical sectors including healthcare, transportation, manufacturing, and energy, these vulnerabilities represent substantial risks to both digital assets and real-world safety systems.
Experience faster, more accurate phishing detection and enhanced protection for your business with real-time sandbox analysis-> Try ANY.RUN now
