CVE-2025-3940: Medium Validation Flaw in Tridium Niagara

CVE-2025-3940 is a medium severity flaw (CVSS 5.3) in Tridium Niagara Framework and Enterprise Security on Windows, Linux and QNX, described as improper use of the validation framework. Releases before 4.14.2, 4.15.1 and 4.10.11 are affected. Tridium recommends 4.14.2u2, 4.15u1 or 4.10u11, so plan the upgrade.

What's affected

The record names Tridium Niagara Framework and Niagara Enterprise Security on Windows, Linux and QNX. Affected versions are before 4.14.2, before 4.15.1 and before 4.10.11, so three supported release lines are covered. The description says the flaw allows input data manipulation, because the validation framework is not used correctly.

Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15u1 or 4.10u11. The record writes the last two with slightly different punctuation, so confirm the exact build names in Tridium's bulletin.

The record lists the weakness as CWE-1173 (improper use of the validation framework). The CVSS 3.1 score is 5.3 (medium), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The vector shows the flaw can be reached over the network, and no login is needed. Confidentiality impact is rated no, integrity low and availability no.

The record does not say this flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false.

How to check if you're exposed

Niagara is an industrial and building automation platform, so the checks are about inventory and version.

1. Find the Niagara version on each system. Open the product's version or about information in Workbench, or in the station's platform details, and note the release line (4.10, 4.14 or 4.15) and the update level.
2. Compare it with the fixed builds in the record: 4.14.2u2, 4.15u1 and 4.10u11. Anything older than the fixed build in its line needs the update.
3. Confirm the operating system of each Niagara host, because this CVE applies only on Windows, Linux and QNX.
4. Open the Tridium and Honeywell security notices listed in the record, and check the technical bulletin for this CVE for any extra steps.

Niagara is a vendor product, not a package you install from a registry, so a dependency scan will not show it. The Gold directory lets you look up other CVEs by product, and your asset inventory is the right place to track Niagara versions.

What to do now

1. Plan the upgrade to the fixed build for your release line: 4.14.2u2, 4.15u1 or 4.10u11. Confirm the exact names in Tridium's bulletin.
2. Take a backup of each station and its configuration before you upgrade, and test on a non production system if you have one.
3. Keep Niagara systems off the public internet. Place them in a segmented network, reachable only through a VPN or a managed gateway.
4. Review which accounts and services can reach the platform, and remove anything that is not needed.
5. Inventory every Niagara system, including the operating system it runs on, so that you can tell which of the related CVEs apply to each.
6. Subscribe to Tridium and Honeywell security notices so the next bulletin reaches you quickly.

Why it matters

The record lists CWE-1173, improper use of the validation framework. Most platforms provide shared code for checking input. The weakness appears when the code does not call it, or calls it in a way that skips checks, so some input reaches logic that assumed it was clean.

The vector shows the flaw is reachable over the network with no login, and that the impact is a low change to integrity. That is why the score is 5.3. In an operational network, a small change to data can still matter, because other systems act on the values they read. The record gives no more detail, so rely on the vendor bulletin.

Quick check

Sources

• Gold entry for CVE-2025-3940
• NVD record for CVE-2025-3940, published 2025-05-22, as summarized above
• Honeywell product security notices, listed in the record
• Niagara Community technical bulletins, listed in the record

Last reviewed: 18 October 2026.