Tridium records

20 published records for vendor tridium.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

20 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
41Plan	CVE-2017-16748No exploit	An attacker can log into the local Niagara platform (Niagara AX Framework Versions 3.8 and prior or Niagara 4 Framework Versions 4.4 and pritridium · niagara · CWE-287 Pre-auth Auth bypass	Critical9.8	—	5.1%	Aug 20, 2018
39Monitor	CVE-2012-4701No exploit	Directory traversal vulnerability in Tridium Niagara AX 3.5, 3.6, and 3.7 allows remote attackers to read sensitive files, and consequently tridium · niagara ax · CWE-22 pre-auth RCE Path traversal	Critical9.3	—	6.4%	Feb 15, 2013
39Monitor	CVE-2025-3945No exploit	Improper Neutralization of Argument Delimiters in a Command (‘Argument Injection’)tridium · niagara · CWE-88 Pre-auth	Critical9.8	—	0.7%	May 22, 2025
39Monitor	CVE-2025-3941No exploit	Improper Handling of Windows: DATA Alternate Data Streamtridium · niagara · CWE-69 Pre-auth	Critical9.8	—	0.5%	May 22, 2025
39Monitor	CVE-2025-3944No exploit	Incorrect Permission Assignment for Critical Resourcetridium · niagara · CWE-732 Pre-auth	Critical9.8	—	0.5%	May 22, 2025
39Monitor	CVE-2025-3936No exploit	Incorrect Permission Assignment for Critical Resourcetridium · niagara · CWE-732 Pre-auth	Critical9.8	—	0.4%	May 22, 2025
39Monitor	CVE-2025-3940No exploit	Improper Use of Validation Frameworktridium · niagara · CWE-1173 Pre-auth	Critical9.8	—	0.4%	May 22, 2025
39Monitor	CVE-2025-3937No exploit	Use of Password Hash with Insufficient Computational Efforttridium · niagara · CWE-916 Pre-auth	Critical9.8	—	0.4%	May 22, 2025
39Monitor	CVE-2025-3938No exploit	Missing Cryptographic Steptridium · niagara · CWE-325 Pre-auth	Critical9.8	—	0.3%	May 22, 2025
33Monitor	CVE-2025-3943No exploit	Use of GET Request Method With sensitive Query Stringstridium · niagara · CWE-598 Pre-auth	High7.5	—	10.7%	May 22, 2025
31Monitor	CVE-2012-4028No exploit	Tridium Niagara AX Framework does not properly store credential data, which allows context-dependent attackers to bypass intended access restridium · niagara ax · CWE-522 Pre-auth Info leak	High7.8	—	1.6%	Jul 16, 2012
30Monitor	CVE-2017-16744Proof of concept	A path traversal vulnerability in Tridium Niagara AX Versions 3.8 and prior and Niagara 4 systems Versions 4.4 and prior installed on Microstridium · niagara · CWE-22 Path traversal	High7.2	—	6.2%	Aug 20, 2018
30Monitor	CVE-2025-3942No exploit	Improper Output Neutralization for Logstridium · niagara · CWE-117 Pre-auth	High7.5	—	0.3%	May 22, 2025
21Monitor	CVE-2012-4027No exploit	Directory traversal vulnerability in Tridium Niagara AX Framework allows remote attackers to read files outside of the intended images, nav,tridium · niagara ax · CWE-22 Pre-auth Path traversal	Medium5.0	—	2.5%	Jul 16, 2012
21Monitor	CVE-2012-3024No exploit	Tridium Niagara AX Framework through 3.6 uses predictable values for (1) session IDs and (2) keys, which might allow remote attackers to byptridium · niagara ax · CWE-287 Pre-auth Auth bypass	Medium5.0	—	2.2%	Aug 16, 2012
21Monitor	CVE-2012-3025No exploit	The default configuration of Tridium Niagara AX Framework through 3.6 uses a cleartext base64 format for transmission of credentials in cooktridium · niagara ax · CWE-522 Pre-auth Info leak	Medium5.0	—	1.9%	Aug 16, 2012
21Monitor	CVE-2018-18985No exploit	Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2tridium · niagara · CWE-79 XSS	Medium5.4	—	1.0%	Jan 29, 2019
21Monitor	CVE-2025-3939No exploit	Observable Response Discrepancytridium · niagara · CWE-204 Pre-auth	Medium5.3	—	0.3%	May 22, 2025
17Monitor	CVE-2020-14483No exploit	A timeout during a TLS handshake can result in the connection failing to terminate.tridium · niagara · CWE-1088 Pre-auth Denial of service	Medium4.3	—	0.4%	Aug 13, 2020
17Monitor	CVE-2019-13528No exploit	A specific utility may allow an attacker to gain read access to privileged files in the Niagara AX 3.8u4 (JACE 3e, JACE 6e, JACE 7, JACE-800tridium · niagara ax · CWE-285 Local privilege escalation Broken access control (IDOR)	Medium4.4	—	0.4%	Sep 24, 2019

CVE-2017-16748
41Plan
An attacker can log into the local Niagara platform (Niagara AX Framework Versions 3.8 and prior or Niagara 4 Framework Versions 4.4 and pri
CriticalCVSS 9.8No exploitEPSS 5%
- Pre-auth
- Auth bypass
tridium · niagaraAug 20, 2018
CVE-2012-4701
39Monitor
Directory traversal vulnerability in Tridium Niagara AX 3.5, 3.6, and 3.7 allows remote attackers to read sensitive files, and consequently
CriticalCVSS 9.3No exploitEPSS 6%
- pre-auth RCE
- Path traversal
tridium · niagara axFeb 15, 2013
CVE-2025-3945
39Monitor
Improper Neutralization of Argument Delimiters in a Command (‘Argument Injection’)
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
tridium · niagaraMay 22, 2025
CVE-2025-3941
39Monitor
Improper Handling of Windows: DATA Alternate Data Stream
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
tridium · niagaraMay 22, 2025
CVE-2025-3944
39Monitor
Incorrect Permission Assignment for Critical Resource
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
tridium · niagaraMay 22, 2025
CVE-2025-3936
39Monitor
Incorrect Permission Assignment for Critical Resource
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
tridium · niagaraMay 22, 2025
CVE-2025-3940
39Monitor
Improper Use of Validation Framework
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
tridium · niagaraMay 22, 2025
CVE-2025-3937
39Monitor
Use of Password Hash with Insufficient Computational Effort
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
tridium · niagaraMay 22, 2025
CVE-2025-3938
39Monitor
Missing Cryptographic Step
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
tridium · niagaraMay 22, 2025
CVE-2025-3943
33Monitor
Use of GET Request Method With sensitive Query Strings
HighCVSS 7.5No exploitEPSS 11%
- Pre-auth
tridium · niagaraMay 22, 2025
CVE-2012-4028
31Monitor
Tridium Niagara AX Framework does not properly store credential data, which allows context-dependent attackers to bypass intended access res
HighCVSS 7.8No exploitEPSS 2%
- Pre-auth
- Info leak
tridium · niagara axJul 16, 2012
CVE-2017-16744
30Monitor
A path traversal vulnerability in Tridium Niagara AX Versions 3.8 and prior and Niagara 4 systems Versions 4.4 and prior installed on Micros
HighCVSS 7.2Proof of conceptEPSS 6%
- Path traversal
tridium · niagaraAug 20, 2018
CVE-2025-3942
30Monitor
Improper Output Neutralization for Logs
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
tridium · niagaraMay 22, 2025
CVE-2012-4027
21Monitor
Directory traversal vulnerability in Tridium Niagara AX Framework allows remote attackers to read files outside of the intended images, nav,
MediumCVSS 5.0No exploitEPSS 3%
- Pre-auth
- Path traversal
tridium · niagara axJul 16, 2012
CVE-2012-3024
21Monitor
Tridium Niagara AX Framework through 3.6 uses predictable values for (1) session IDs and (2) keys, which might allow remote attackers to byp
MediumCVSS 5.0No exploitEPSS 2%
- Pre-auth
- Auth bypass
tridium · niagara axAug 16, 2012
CVE-2012-3025
21Monitor
The default configuration of Tridium Niagara AX Framework through 3.6 uses a cleartext base64 format for transmission of credentials in cook
MediumCVSS 5.0No exploitEPSS 2%
- Pre-auth
- Info leak
tridium · niagara axAug 16, 2012
CVE-2018-18985
21Monitor
Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2
MediumCVSS 5.4No exploitEPSS 1%
- XSS
tridium · niagaraJan 29, 2019
CVE-2025-3939
21Monitor
Observable Response Discrepancy
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
tridium · niagaraMay 22, 2025
CVE-2020-14483
17Monitor
A timeout during a TLS handshake can result in the connection failing to terminate.
MediumCVSS 4.3No exploitEPSS 0%
- Pre-auth
- Denial of service
tridium · niagaraAug 13, 2020
CVE-2019-13528
17Monitor
A specific utility may allow an attacker to gain read access to privileged files in the Niagara AX 3.8u4 (JACE 3e, JACE 6e, JACE 7, JACE-800
MediumCVSS 4.4No exploitEPSS 0%
- Local privilege escalation
- Broken access control (IDOR)
tridium · niagara axSep 24, 2019