Executive brief
Tridium Niagara Framework and Enterprise Security, which are used to manage building automation and security systems, contain a vulnerability in how they handle user permissions. An attacker with high-level access on the local network could exploit this flaw to abuse their privileges and gain unauthorized access to sensitive information. This could lead to the exposure of confidential operational data or unauthorized changes to system settings.
Technical details
A vulnerability classified as Improper Handling of Insufficient Permissions or Privileges (CWE-280) exists in Tridium Niagara Framework and Niagara Enterprise Security. The flaw resides in the permission management logic across Windows, Linux, and QNX platforms. An attacker with high privileges (PR:H) and access to the adjacent network (AV:A) can exploit this to perform actions beyond their intended scope, specifically resulting in high confidentiality impact and low integrity impact. The issue is addressed in Niagara Framework and Niagara Enterprise Security versions 4.14.6 and 4.15.5.
Affected products
- Tridium Niagara Framework before 4.14.6, before 4.15.5
- Tridium Niagara Enterprise Security before 4.14.6, before 4.15.5
Timeline
- 2026-07-23: disclosed
- 2026-07-23: advisory