Tridium Niagara Framework and Enterprise Security Argument Injection Vulnerability on QNX

A vulnerability allowing improper neutralization of argument delimiters, known as argument injection, has been identified in the Tridium Niagara Framework and Niagara Enterprise Security, both on QNX. This vulnerability allows command delimiters to be manipulated. Affected versions include Niagara Framework prior to 4.14.2, 4.15.1, and 4.10.11, as well as Niagara Enterprise Security versions prior to 4.14.2, 4.15.1, and 4.10.11.

Impact

Exploitation of this vulnerability could lead to unauthorized command execution by injecting malicious arguments that are not properly sanitized, potentially allowing attackers to manipulate application behavior or access sensitive information.

Remediation

Users are advised to upgrade to Tridium Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.