CVE-2025-3937

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-3937", "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "state": "PUBLISHED", "assignerShortName": "Honeywell", "dateReserved": "2025-04-25T15:21:14.598Z", "datePublished": "2025-05-22T12:23:42.058Z", "dateUpdated": "2025-05-22T14:43:13.538Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "platforms": ["Windows", "Linux", "QNX"], "product": "Niagara Framework", "vendor": "Tridium", "versions": [{"lessThan": "4.14.2", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "4.15.1", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "4.10.11", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "affected", "platforms": ["Windows", "Linux", "QNX"], "product": "Niagara Enterprise Security", "vendor": "Tridium", "versions": [{"lessThan": "4.14.2", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "4.15.1", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "4.10.11", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Andrea Palanca and team at Nozomi Networks"}], "datePublic": "2025-05-08T16:59:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."}], "value": "Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."}], "impacts": [{"capecId": "CAPEC-97", "descriptions": [{"lang": "en", "value": "CAPEC-97 Cryptanalysis"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-916", "description": "CWE-916 Use of Password Hash With Insufficient Computational Effort", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "shortName": "Honeywell", "dateUpdated": "2025-05-22T12:50:14.135Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://docs.niagara-community.com/category/tech_bull"}, {"tags": ["vendor-advisory"], "url": "https://www.honeywell.com/us/en/product-security#security-notices"}], "source": {"discovery": "UNKNOWN"}, "title": "Use of Password Hash with Insufficient Computational Effort", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-22T14:29:29.244650Z", "id": "CVE-2025-3937", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-22T14:43:13.538Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3937", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-22T14:29:29.244650Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-22T14:39:46.222Z"}}], "cna": {"title": "Use of Password Hash with Insufficient Computational Effort", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Andrea Palanca and team at Nozomi Networks"}], "impacts": [{"capecId": "CAPEC-97", "descriptions": [{"lang": "en", "value": "CAPEC-97 Cryptanalysis"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Tridium", "product": "Niagara Framework", "versions": [{"status": "affected", "version": "0", "lessThan": "4.14.2", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "4.15.1", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "4.10.11", "versionType": "custom"}], "platforms": ["Windows", "Linux", "QNX"], "defaultStatus": "affected"}, {"vendor": "Tridium", "product": "Niagara Enterprise Security", "versions": [{"status": "affected", "version": "0", "lessThan": "4.14.2", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "4.15.1", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "4.10.11", "versionType": "custom"}], "platforms": ["Windows", "Linux", "QNX"], "defaultStatus": "affected"}], "datePublic": "2025-05-08T16:59:00.000Z", "references": [{"url": "https://docs.niagara-community.com/category/tech_bull", "tags": ["vendor-advisory"]}, {"url": "https://www.honeywell.com/us/en/product-security#security-notices", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.", "supportingMedia": [{"type": "text/html", "value": "Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-916", "description": "CWE-916 Use of Password Hash With Insufficient Computational Effort"}]}], "providerMetadata": {"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "shortName": "Honeywell", "dateUpdated": "2025-05-22T12:50:14.135Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3937", "state": "PUBLISHED", "dateUpdated": "2025-05-22T14:43:13.538Z", "dateReserved": "2025-04-25T15:21:14.598Z", "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "datePublished": "2025-05-22T12:23:42.058Z", "assignerShortName": "Honeywell"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "platforms": ["Windows", "Linux", "QNX"], "product": "Niagara Framework", "vendor": "Tridium", "versions": [{"lessThan": "4.14.2", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "4.15.1", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "4.10.11", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "affected", "platforms": ["Windows", "Linux", "QNX"], "product": "Niagara Enterprise Security", "vendor": "Tridium", "versions": [{"lessThan": "4.14.2", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "4.15.1", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "4.10.11", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "psirt@honeywell.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tridium:niagara:4.10u10:*:*:*:*:*:*:*", "matchCriteriaId": "0615B9FA-E837-4C21-8968-F3273718DF7D", "vulnerable": true}, {"criteria": "cpe:2.3:a:tridium:niagara:4.14u1:*:*:*:*:*:*:*", "matchCriteriaId": "BEE26A6F-876E-450D-8A5F-EF4A3EF96A13", "vulnerable": true}, {"criteria": "cpe:2.3:a:tridium:niagara:4.15:*:*:*:*:*:*:*", "matchCriteriaId": "00C6667A-9873-4A75-AB11-3427AA1E552D", "vulnerable": true}, {"criteria": "cpe:2.3:a:tridium:niagara_enterprise_security:4.10u10:*:*:*:*:*:*:*", "matchCriteriaId": "E694C4DB-66F7-4753-81D8-9085B5E3A207", "vulnerable": true}, {"criteria": "cpe:2.3:a:tridium:niagara_enterprise_security:4.14u1:*:*:*:*:*:*:*", "matchCriteriaId": "506E75F5-D259-4BAC-9C1A-83C9AD54D608", "vulnerable": true}, {"criteria": "cpe:2.3:a:tridium:niagara_enterprise_security:4.15:*:*:*:*:*:*:*", "matchCriteriaId": "6DF70636-5B89-4646-80F3-83C906B0EB3C", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:blackberry:qnx:-:*:*:*:*:*:*:*", "matchCriteriaId": "3642981A-848E-4DEA-A904-A83B9ED4891D", "vulnerable": false}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.\u00a0Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11."}, {"lang": "es", "value": "Vulnerabilidad de uso de hash de contrase\u00f1a con esfuerzo computacional insuficiente en Tridium Niagara Framework para Windows, Linux y QNX, Tridium Niagara Enterprise Security para Windows, Linux y QNX permite el criptoan\u00e1lisis. Este problema afecta a Niagara Framework: versiones anteriores a la 4.14.2, 4.15.1 y 4.10.11; Niagara Enterprise Security: versiones anteriores a la 4.14.2, 4.15.1 y 4.10.11. Tridium recomienda actualizar a las versiones 4.14.2u2, 4.15.u1 o 4.10u.11 de Niagara Framework y Enterprise Security."}], "id": "CVE-2025-3937", "lastModified": "2026-06-17T09:20:57.577", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "psirt@honeywell.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-3937", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-05-22T14:29:29.244650Z", "version": "2.0.3"}}]}, "published": "2025-05-22T13:15:56.457", "references": [{"source": "psirt@honeywell.com", "tags": ["Permissions Required"], "url": "https://docs.niagara-community.com/category/tech_bull"}, {"source": "psirt@honeywell.com", "tags": ["Vendor Advisory"], "url": "https://www.honeywell.com/us/en/product-security#security-notices"}], "sourceIdentifier": "psirt@honeywell.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-916"}], "source": "psirt@honeywell.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-916"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}