Tridium Niagara Framework and Niagara Enterprise Security (before 4.10.11 / 4.14.2 / 4.15.1): A chain, not a single

Impact

A chain, not a single bug, and the chain is what matters. Password hashes are stored with insufficient computational effort so they crack offline; a missing cryptographic step and an observable response discrepancy help an attacker recover or confirm credentials; incorrect permission assignment on the QNX-based JACE controllers allows file manipulation; and an argument-injection path on QNX turns that into command execution. Put together, an attacker with a foothold anywhere near the station escalates to control of the Niagara supervisor and the JACE field controllers underneath it - which is direct write access to cooling commands and setpoints for the whole site. Niagara Enterprise Security is affected too, so on sites that use it the same chain reaches door control. The operator-facing consequence is loss of thermal control over the hall plus, potentially, loss of the physical access boundary around the cages, from one credential-recovery weakness.

Who can reach it

Requires reaching the Niagara station or capturing its authentication material - so a compromised facilities workstation, a foothold on the building network, an integrator's remote path, or an internet-exposed station. The QNX permission and argument-injection pieces then apply on the JACE hardware controllers themselves, which sit on the facility VLAN and are rarely monitored by anyone.

What to do

Upgrade the framework to 4.10.11, 4.14.2 or 4.15.1 (or later) per the Tridium/Honeywell tech bulletins. This is a supervisor software upgrade plus a firmware push to every JACE, done by the integrator - a real project, typically a scheduled outage of supervisory control while field controllers keep running standalone. After upgrading, rotate every Niagara credential, because the old hashes are assumed compromised. Compensating controls while you wait: restrict the station to a jump host, enforce MFA on the path to it, and put the JACEs behind an allow-list. If your Niagara estate is integrator-managed under a service contract, the upgrade is a billable engagement - price it now rather than discovering it during an incident.

References