What’s Vulnerable › Vulnerabilities

CVE-2025-3945: Improper Neutralization of Argument Delimiters in a Command (‘Argument Injection’)

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-05-22 · updated 2026-06-17
• Weakness: CWE-88

Description

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows Command Delimiters. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.

Affected products

• Tridium Niagara: 4.10u10, 4.14u1, 4.15
• Tridium Niagara Enterprise Security: 4.10u10, 4.14u1, 4.15

References

• https://docs.niagara-community.com/category/tech_bull
• https://honeywell.com/us/en/product-security#security-notices

Get alerted when CVE-2025-3945 or the next vulnerability affects your stack