EUVD-2026-48289
GHSA-769r-j4hr-6567
Severity by source
AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Adjacent vector and PR:H both confirmed by exploitation preconditions; C:H reflects information disclosure of sensitive operational data with no availability impact.
Primary rating from Vendor (Honeywell).
CVSS VectorVendor: Honeywell
Lifecycle Timeline
3DescriptionCVE.org
Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse.
This issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5.
AnalysisAI
Privilege abuse in Tridium Niagara Framework and Niagara Enterprise Security allows an authenticated high-privileged user on an adjacent network to improperly access confidential data and perform limited unauthorized modifications beyond their sanctioned scope. Affected platforms span Windows, Linux, and QNX, and versions prior to 4.14.6 and 4.15.5 are vulnerable. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Technical ContextAI
Tridium Niagara is a Java-based industrial IoT and building automation framework widely used in HVAC, lighting, energy management, and physical security systems. CWE-280 (Improper Handling of Insufficient Permissions or Privileges) indicates the framework fails to properly enforce permission boundaries when a user with high-level credentials attempts operations, allowing that role to exceed its authorized access. The affected CPE strings - cpe:2.3:a:tridium:niagara_framework and cpe:2.3:a:tridium:niagara_enterprise_security - confirm both the core operational framework and its enterprise security management layer are affected. The adjacent network attack vector (AV:A) implies exploitation requires the attacker to be on the same network segment, subnet, or logical broadcast domain as the Niagara controller or server, which is consistent with typical OT/BAS network topologies. The 'Microsoft' tag in the source intelligence may reflect tagging artifact and does not appear relevant to the vulnerability mechanics.
RemediationAI
Upgrade Niagara Framework and Niagara Enterprise Security to version 4.14.6 or 4.15.5 (or later in their respective branches) as confirmed in the CVE description. Vendor guidance is available at https://www.tridium.com/us/en/product-security and https://www.honeywell.com/us/en/product-security. Where immediate patching is not feasible, apply network segmentation to ensure Niagara controllers and servers are isolated on dedicated OT VLANs inaccessible from broader enterprise or guest networks, which directly mitigates the AV:A attack vector. Additionally, audit and reduce the number of accounts with high-privileged access to Niagara, enforce multi-factor authentication where supported, and monitor for anomalous data access patterns by privileged accounts. These compensating controls reduce but do not eliminate risk - patch deployment remains the authoritative fix.
More in Niagara Framework
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today