{"id":"CVE-2025-3943","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-3943","generatedAt":"2026-11-03T20:37:59.322Z","title":"Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Parameter Injection.","description":"Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Parameter Injection. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.","published":"2025-05-22T13:15:57.000Z","lastModified":"2026-06-17T09:20:58.000Z","status":"Analyzed","sourceIdentifier":"psirt@honeywell.com","cvss":{"version":"3.1","score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-598"],"affected":["tridium/niagara","tridium/niagara enterprise security"],"epss":{"score":0.11383,"percentile":0.95994,"date":"2026-11-02","history":[{"date":"2026-10-29","score":0.11383,"percentile":0.95982}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 11.4%, higher than 96% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"https://docs.niagara-community.com/category/tech_bull","tags":["Permissions Required"],"source":"psirt@honeywell.com"},{"url":"https://honeywell.com/us/en/product-security#security-notices","tags":["Vendor Advisory"],"source":"psirt@honeywell.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-3943","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}