Cyber Resilience

CVE-2025-3943

Medium

Published: 22 May 2025

Published
22 May 2025
Modified
04 June 2025
KEV Added
—
Patch
—
CVSS Score v3.1 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
EPSS Score 0.0042 62.5th percentile
Risk Priority 8 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-3943 is a medium-severity Use of HTTP Request With Sensitive Query String (CWE-598) vulnerability in Tridium Niagara. Its CVSS base score is 4.1 (Medium).

Operationally, ranked in the top 37.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Parameter Injection. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11;…

more

Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.

CWE(s)
CWE-598NVD-CWE-Other

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

tridium
niagara
4.10u10, 4.14u1, 4.15
tridium
niagara enterprise security
4.10u10, 4.14u1, 4.15

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-9 Transmission Confidentiality
addresses: CWE-598

Protects sensitive data placed in query strings from interception in transit when confidentiality controls like HTTPS are enforced.

References