CVE-2025-3937 is a high severity flaw (CVSS 7.7) in Tridium Niagara Framework and Enterprise Security on Windows, Linux and QNX. Password hashes use insufficient computational effort. Releases before 4.14.2, 4.15.1 and 4.10.11 are affected. Tridium recommends 4.14.2u2, 4.15u1 or 4.10u11, so plan the upgrade.
What's affected
The record names Tridium Niagara Framework and Niagara Enterprise Security on Windows, Linux and QNX. Affected versions are before 4.14.2, before 4.15.1 and before 4.10.11, so three supported release lines are covered. The description says the flaw allows cryptanalysis, because passwords are hashed with an approach that takes too little computational effort.
Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15u1 or 4.10u11. The record writes the last two with slightly different punctuation, so confirm the exact build names in Tridium's bulletin.
The record lists the weakness as CWE-916 (use of a password hash with insufficient computational effort). The CVSS 3.1 score is 7.7 (high), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. The vector shows the flaw can be reached over the network, and a low privilege account is needed. Confidentiality impact is rated high, integrity no and availability no.
The record does not say this flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false.
How to check if you're exposed
Niagara is an industrial and building automation platform, so the checks are about inventory and version.
- Find the Niagara version on each system. Open the product's version or about information in Workbench, or in the station's platform details, and note the release line (4.10, 4.14 or 4.15) and the update level.
- Compare it with the fixed builds in the record: 4.14.2u2, 4.15u1 and 4.10u11. Anything older than the fixed build in its line needs the update.
- Confirm the operating system of each Niagara host, because this CVE applies only on Windows, Linux and QNX.
- Open the Tridium and Honeywell security notices listed in the record, and check the technical bulletin for this CVE for any extra steps.
Niagara is a vendor product, not a package you install from a registry, so a dependency scan will not show it. The Gold directory lets you look up other CVEs by product, and your asset inventory is the right place to track Niagara versions.
What to do now
- After the upgrade, follow the bulletin's guidance on credentials, and change passwords for accounts with wide access.
- Plan the upgrade to the fixed build for your release line: 4.14.2u2, 4.15u1 or 4.10u11. Confirm the exact names in Tridium's bulletin.
- Take a backup of each station and its configuration before you upgrade, and test on a non production system if you have one.
- Keep Niagara systems off the public internet. Place them in a segmented network, reachable only through a VPN or a managed gateway.
- Review which accounts and services can reach the platform, and remove anything that is not needed.
- Inventory every Niagara system, including the operating system it runs on, so that you can tell which of the related CVEs apply to each.
- Subscribe to Tridium and Honeywell security notices so the next bulletin reaches you quickly.
Why it matters
The record lists CWE-916, use of a password hash with insufficient computational effort. A password hash should be slow to compute, so that guessing many passwords against a stolen hash is costly. A fast hash lets an attacker who obtains the stored values test guesses quickly.
The vector rates this as reachable over the network with a low privilege account, with a high impact on confidentiality and a changed scope. The record does not describe how the hashes are obtained, so rely on the vendor bulletin for that. The practical lesson is that stored credentials are only as safe as the hash that protects them. After upgrading, ask whether the bulletin recommends changing passwords, and do so for accounts with broad access.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which versions fix CVE-2025-3937?
The record says versions before 4.14.2, 4.15.1 and 4.10.11 are affected and recommends 4.14.2u2, 4.15u1 or 4.10u11. Confirm the names in Tridium's bulletin.
Should I change passwords?
Check Tridium's bulletin for guidance. Changing passwords after the upgrade is a sensible precaution for accounts with wide access, since a hash that was weak before the upgrade may have been exposed.
Sources
- Gold entry for CVE-2025-3937
- NVD record for CVE-2025-3937, published 2025-05-22, as summarized above
- Honeywell product security notices, listed in the record
- Niagara Community technical bulletins, listed in the record
Last reviewed: 18 October 2026.
