Cyber Resilience

CVE-2025-3941

Tridium Niagara 4.10u10 … 4.15

Published
22 May 2025
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v3.1 5.4
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.0047 39th percentile
Risk Priority 44 floored blend · peak EPSS

Summary

CVE-2025-3941 is a medium-severity Improper Handling of Windows ::DATA Alternate Data Stream (CWE-69) vulnerability in Tridium Niagara. Its CVSS base score is 5.4 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Fileless Storage (T1027.011); ranked at the 39th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before…

more

4.14.2, before 4.15.1, before 4.10.11.Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.

CWE(s)
CWE-69CWE-706

Related Threats

MITRE ATT&CK Enterprise Techniques

T1027.011 Fileless Storage Stealth
Adversaries may store data in "fileless" formats to conceal malicious activity from defenses.
attack.mitre.org →
T1034 Path Interception Persistence
**This technique has been deprecated.
attack.mitre.org →
T1564 Hide Artifacts Stealth
Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.
attack.mitre.org →
T1027 Obfuscated Files or Information Stealth
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.
attack.mitre.org →
T1564.004 NTFS File Attributes Stealth
Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection.
attack.mitre.org →
T1574.008 Path Interception by Search Order Hijacking Stealth
Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-3936Same product: Microsoft Windows
CVE-2024-43033Same product: Microsoft Windows
CVE-2025-3940Same product: Microsoft Windows
CVE-2025-3939Same product: Microsoft Windows
CVE-2025-3942Same product: Microsoft Windows
CVE-2025-3943Same product: Microsoft Windows
CVE-2025-3938Same product: Microsoft Windows
CVE-2025-3944Same product: Microsoft Windows
CVE-2025-3937Same product: Microsoft Windows
CVE-2025-3945Same product: Tridium Niagara

Affected Assets

tridium
niagara
4.10u10, 4.14u1, 4.15
tridium
niagara enterprise security
4.10u10, 4.14u1, 4.15

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

Access enforcement that recognizes all NTFS file access methods will block unauthorized use of ::$DATA streams.

AC-4 Information Flow Enforcement partial match

Information-flow rules applied at the file-system level can treat ADS contents as distinct flows that must be authorized.

AU-6 Audit Record Review, Analysis, and Reporting partial match

Review of file-access audit records can reveal creation or use of alternate data streams after the fact.

SI-4 System Monitoring partial match

System monitoring configured to watch for ADS-specific file operations can surface hidden-stream activity.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

DE.CM-09 mostly match
prevents

Monitoring of runtime data and file activity directly detects or blocks hidden ADS usage.

PR.PS-06 mostly match
prevents

Secure-development practices directly prevent incorrect name/reference resolution bugs during coding.

DE.CM-03 partial match
prevents

Behavioral monitoring of technology usage may surface ADS anomalies as side effects.

PR.AA-05 partial match
prevents

Enforced authorization boundaries limit damage from an incorrectly resolved reference.

PR.IR-01 partial match
prevents

Logical segmentation and access controls reduce the chance an out-of-sphere resolution succeeds.

PR.PS-01 partial match
prevents

Hardened configuration baselines can constrain allowable name-to-resource mappings.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect incorrect name or reference resolution through fuzzing and negative test cases.

A.8.15 Logging partial match
finds

Logging of file-system events can record ADS access attempts, aiding detection, but does not prevent the weakness itself.

A.8.16 Monitoring activities partial match
finds

Monitoring activities can flag anomalous ADS usage, providing partial mitigation through detection rather than prevention.

A.8.20 Networks security partial match
degrades

Network segmentation and routing policies reduce the chance that a mis-resolved name leads to an unintended external resource.

A.8.22 Segregation of networks partial match
degrades

Segregated networks limit the blast radius when a name or reference resolves outside the intended control sphere.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC practices include design reviews that can catch incorrect name or reference handling before deployment.

References