Tridium Niagara Framework and Enterprise Security Password Hash Vulnerability Allowing Cryptanalysis

A vulnerability exists in the Tridium Niagara Framework and Niagara Enterprise Security, all prior to certain versions, due to the use of password hashes that require insufficient computational effort. This weakness allows for cryptanalysis, potentially compromising password security.

Impact

Exploitation of this vulnerability could lead to successful cryptographic attacks, allowing an adversary to recover passwords or password equivalents, thereby gaining unauthorized access to user accounts or systems.

Remediation

Users are advised to upgrade to Tridium Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.