CVE-2025-3937

Use of Password Hash with Insufficient Computational Effort

State: Published
Severity: 7.7 High
Published: May 22, 2025
Updated: May 22, 2025
Reserved: Apr 25, 2025

Description

Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.

Scores

CVSS	Score	Vector	Source
3.1	7.7 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N	Honeywell

Weaknesses

CWE-916 Use of Password Hash With Insufficient Computational Effort

Affected Products

Product	Versions
Niagara FrameworkTridium	before 4.14.2Affected before 4.15.1Affected before 4.10.11Affected
Niagara Enterprise SecurityTridium	before 4.14.2Affected before 4.15.1Affected before 4.10.11Affected

References

https://docs.niagara-community.com/category/tech_bullvendor-advisory
https://www.honeywell.com/us/en/product-security#security-noticesvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.