Improper Handling of Windows: DATA Alternate Data Stream
Priority MEDIUM 43CWE-69Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00502 43rd percentileScored 2026-11-07
Fix Fixed Niagara Framework (Tridium): 4.14.2, 4.15.1, 4.10.11Niagara Enterprise Security (Tridium): 4.14.2, 4.15.1, 4.10.11
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Tridium | Niagara Framework | before 4.14.2; before 4.15.1; before 4.10.11 | 4.14.2, 4.15.1, 4.10.11 | Patch available | CNA |
| Tridium | Niagara Enterprise Security | before 4.14.2; before 4.15.1; before 4.10.11 | 4.14.2, 4.15.1, 4.10.11 | Patch available | CNA |
- Niagara Framework VendorTridium Affected before 4.14.2; before 4.15.1; before 4.10.11 Fixed in 4.14.2, 4.15.1, 4.10.11 Patch available CNA
- Niagara Enterprise Security VendorTridium Affected before 4.14.2; before 4.15.1; before 4.10.11 Fixed in 4.14.2, 4.15.1, 4.10.11 Patch available CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tridium:niagara:4.10u10:*:*:*:*:*:*:* | 4.10u10 | Vulnerable | Tridium |
| cpe:2.3:a:tridium:niagara:4.14u1:*:*:*:*:*:*:* | 4.14u1 | Vulnerable | Tridium |
| cpe:2.3:a:tridium:niagara:4.15:*:*:*:*:*:*:* | 4.15 | Vulnerable | Tridium |
| cpe:2.3:a:tridium:niagara_enterprise_security:4.10u10:*:*:*:*:*:*:* | 4.10u10 | Vulnerable | Tridium |
| cpe:2.3:a:tridium:niagara_enterprise_security:4.14u1:*:*:*:*:*:*:* | 4.14u1 | Vulnerable | Tridium |
| cpe:2.3:a:tridium:niagara_enterprise_security:4.15:*:*:*:*:*:*:* | 4.15 | Vulnerable | Tridium |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:tridium:niagara:4.10u10:*:*:*:*:*:*:* Versions 4.10u10 Vulnerable ·Tridium
- cpe:2.3:a:tridium:niagara:4.14u1:*:*:*:*:*:*:* Versions 4.14u1 Vulnerable ·Tridium
- cpe:2.3:a:tridium:niagara:4.15:*:*:*:*:*:*:* Versions 4.15 Vulnerable ·Tridium
- cpe:2.3:a:tridium:niagara_enterprise_security:4.10u10:*:*:*:*:*:*:* Versions 4.10u10 Vulnerable ·Tridium
- cpe:2.3:a:tridium:niagara_enterprise_security:4.14u1:*:*:*:*:*:*:* Versions 4.14u1 Vulnerable ·Tridium
- cpe:2.3:a:tridium:niagara_enterprise_security:4.15:*:*:*:*:*:*:* Versions 4.15 Vulnerable ·Tridium
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
- Fix · CNA Niagara Framework (Tridium) Fixed in 4.14.2, 4.15.1, 4.10.11
- Fix · CNA Niagara Enterprise Security (Tridium) Fixed in 4.14.2, 4.15.1, 4.10.11
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Tridium Niagara Enterprise Security, Niagara Framework — docs.niagara-community.com/category/tech_bull
9 records Highest priority Priority MEDIUM 8 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-03484 Improper Use of Validation FrameworkPriority MEDIUM 48
- TI-2025-03487 Use of GET Request Method With sensitive Query StringsPriority MEDIUM 46
- TI-2025-03489 Improper Neutralization of Argument Delimiters in a Command (‘Argument Injection’)Priority MEDIUM 44
Timeline
- 2026-10-02 Threatist record created from CVE-2025-3941
- 2026-10-03 Alias added: GHSA-q524-5rg8-2j6p
References
More Tridium Niagara vulnerabilities
- TI-2017-12310 Improper authentication in ICS-CERT Niagara AX Framework and Niagara 4 Framework CVSS 3.0CRITICAL 9.8
- TI-2025-03484 Improper Use of Validation Framework CVSS 3.1CRITICAL 9.8
- TI-2025-03487 Use of GET Request Method With sensitive Query Strings CVSS 3.1HIGH 7.5
- TI-2025-03489 Improper Neutralization of Argument Delimiters in a Command (‘Argument Injection’) CVSS 3.1CRITICAL 9.8
- TI-2025-03488 Incorrect permission assignment in Tridium Niagara Framework CVSS 3.1CRITICAL 9.8
- TI-2025-03482 Broken or risky cryptographic algorithm in Tridium Niagara Framework CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-3941 · CVE Program
- CVE-2025-3941 · NVD
- FIRST EPSS
- GHSA-q524-5rg8-2j6p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences