CVE-2012-3025

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

The default configuration of Tridium Niagara AX Framework through 3.6 uses a cleartext base64 format for transmission of credentials in cookies, which allows remote attackers to obtain sensitive information by sniffing the network.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.tridium.com/cs/tridium_news/security_patch_36Broken Link, Patch, Vendor Advisory
http://www.us-cert.gov/control_systems/pdf/ICSA-12-228-01.pdfBroken Link, Third Party Advisory, US Government Resource
http://www.tridium.com/cs/tridium_news/security_patch_36Broken Link, Patch, Vendor Advisory
http://www.us-cert.gov/control_systems/pdf/ICSA-12-228-01.pdfBroken Link, Third Party Advisory, US Government Resource

Timeline

Published: Aug 16, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-302610.0rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6 through 3.5 SP1 allows remo CVE-2012-30286.8Cross-site request forgery (CSRF) vulnerability in WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other prod CVE-2012-30305.0WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, stores sensitive information under the web ro CVE-2012-30314.3Multiple cross-site scripting (XSS) vulnerabilities in WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other CVE-2012-30327.5SQL injection vulnerability in WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allows remote CVE-2012-30344.3WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allows remote attackers to discover a usernam CVE-2012-30355.0Buffer overflow in Emerson DeltaV 9.3.1 and 10.3 through 11.3.1 allows remote attackers to cause a denial of service (daemon crash) via a lo CVE-2012-30374.3The Siemens SIMATIC S7-1200 2.x PLC does not properly protect the private key of the SIMATIC CONTROLLER Certification Authority certificate,CVE-2012-30397.1Moxa OnCell Gateway G3111, G3151, G3211, and G3251 devices with firmware before 1.4 do not use a sufficient source of entropy for SSH and SS CVE-2012-30404.3Cross-site scripting (XSS) vulnerability in the web server on Siemens SIMATIC S7-1200 PLCs 2.x through 3.0.1 allows remote attackers to inje CVE-2012-30474.3Cross-site scripting (XSS) vulnerability in the web-wizard setup page on Cisco Scientific Atlanta D20 and D30 cable modems allows remote att CVE-2012-30516.1Cisco NX-OS 5.2 and 6.1 on Nexus 7000 series switches allows remote attackers to cause a denial of service (process crash or packet loss) vi