PatchTheCVEniagara vulnerabilities and fixes
Recent CVEs affecting niagara, with upgrade or downgrade steps. 10 tracked.
niagara has 10 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2025-05-22. Highest priority: CVE-2025-3945 (score 38/100).
- CVE-2025-3945 HIGH 7.2 DOWNGRADE DOWNGRADE Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Tridium Ni
- CVE-2025-3944 HIGH 7.2 DOWNGRADE DOWNGRADE Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on QNX, Tridi
- CVE-2025-3943 MEDIUM 4.1 DOWNGRADE DOWNGRADE Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows,
- CVE-2025-3942 MEDIUM 4.3 DOWNGRADE DOWNGRADE Improper Output Neutralization for Logs vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tri
- CVE-2025-3941 MEDIUM 5.4 DOWNGRADE DOWNGRADE Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Window
- CVE-2025-3940 MEDIUM 5.3 DOWNGRADE DOWNGRADE Improper Use of Validation Framework vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridiu
- CVE-2025-3939 MEDIUM 5.3 DOWNGRADE DOWNGRADE Observable Response Discrepancy vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Nia
- CVE-2025-3938 MEDIUM 6.8 DOWNGRADE DOWNGRADE Missing Cryptographic Step vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara
- CVE-2025-3937 HIGH 7.7 DOWNGRADE DOWNGRADE Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Wind
- CVE-2025-3936 MEDIUM 6.5 DOWNGRADE DOWNGRADE Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on Windows, T
FAQ
How do I fix niagara vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is niagara being exploited right now?
None of the tracked niagara CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which niagara CVE should I patch first?
CVE-2025-3945 currently ranks highest (38/100): Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Tridium Ni.