Free Trial

Attackers gain read access to privileged files in Niagara AX

Overview :
A specific utility may allow an attacker to gain read access to privileged files in the Niagara AX 3.8u4 (JACE 3e, JACE 6e, JACE 7, JACE-8000), Niagara 4.4u3 (JACE 3e, JACE 6e, JACE 7, JACE-8000), and Niagara 4.7u1 (JACE-8000, Edge 10).
Affected Product(s) :
  • Niagara AX 3.8u4 (JACE 3e, JACE 6e, JACE 7, JACE-8000)
  • Niagara 4.4u3 (JACE 3e, JACE 6e, JACE 7, JACE-8000)
  • Niagara 4.7u1 (JACE-8000, Edge 10)
Vulnerability Details :
CVE ID : CVE-2019-13528
A specific utility may allow an attacker to gain read access to privileged files.

CVE-2019-13528 has been assigned to this vulnerability. A CVSS v3 base score of 4.4 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).

Solution :

Tridium has released updates that mitigate these vulnerabilities and recommends users update to the versions identified below:

  • Niagara AX 3.8u4:
    • OS Dist: 2.7.402.2
    • NRE Config Dist: 3.8.401.1
  • Niagara 4.4u3:
    • OS Dist: 4.4.73.38.1 NRE Config
    • Dist: 4.4.94.14.1
  • Niagara 4.7u1:
    • OS Dist: (JACE 8000) 4.7.109.16.1
    • OS Dist (Edge 10): 4.7.109.18.1
    • NRE Config Dist: 4.7.110.32.1

Updates are available by contacting the sales support channel or by contacting the Tridium support team at support@tridium.com

Common Vulnerabilityies and Exposures

Contact us to get started

CVE-2023-3065 : MOBATIME AMXGT100 UP TO 1.3.20 IMPROPER AUTHENTICATION

CVE-2023-3065 : MOBATIME AMXGT100 UP TO 1.3.20 IMPROPER AUTHENTICATION

Description Improper Authentication vulnerability in Mobatime mobile application AMXGT100 allows Authentication Bypass.This issue affects Mobatime mobile application AMXGT100 through 1.3.20.

Learn more
CVE-2023-2781 : USER EMAIL VERIFICATION FOR WOOCOMMERCE PLUGIN UP TO 3.5.0 ON WORDPRESS IMPROPER AUTHENTICATION

CVE-2023-2781 : USER EMAIL VERIFICATION FOR WOOCOMMERCE PLUGIN UP TO 3.5.0 ON WORDPRESS IMPROPER AUTHENTICATION

Description The User Email Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass via authenticate_user_by_email in versions up

Learn more
CVE-2023-33965 : BROOK PRIOR 20230606 TPROXY SERVER OS COMMAND INJECTION

CVE-2023-33965 : BROOK PRIOR 20230606 TPROXY SERVER OS COMMAND INJECTION

Description Brook is a cross-platform programmable network tool. The `tproxy` server is vulnerable to a drive-by command injection. An attacker

Learn more