CVE-2025-3945: Improper Neutralization of Argument Delimiters in a Command (‘Argument Injection’)
Description
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows Command Delimiters. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
Classification
CVE ID: CVE-2025-3945
CVSS Base Severity: HIGH
CVSS Base Score: 7.2
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Problem Types
CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')Affected Products
Vendor: Tridium
Product: Niagara Framework, Niagara Enterprise Security
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.06% (probability of being exploited)
EPSS Percentile: 18.91% (scored less or equal to compared to others)
EPSS Date: 2025-06-15 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-3945https://honeywell.com/us/en/product-security#security-notices
https://docs.niagara-community.com/category/tech_bull