CVE-2012-3025: The default configuration of Tridium Niagara AX Framework through 3.6 uses a cleartext base64 format for tr...

Security readout for executives and security teams

Tridium Niagara AX Framework through 3.6 could send credentials in cookies using cleartext Base64 in its default configuration. Base64 is not encryption, so someone able to observe network traffic could recover sensitive login information. Exposure is most likely where Niagara AX Framework through 3.6 remains in use with default credential-cookie behavior and traffic can be observed on the network path. Treat this as a focused legacy operational technology exposure. Prioritize environments where Niagara AX manages sensitive building or industrial systems and where traffic may have crossed shared or untrusted networks. Mitigation focus: Review Tridium's referenced security patch guidance for Niagara AX 3.6.; Apply vendor-provided updates or configuration changes from Tridium guidance.; Review US-CERT ICSA-12-228-01 for vendor-approved remediation direction..

Prepared

Jun 28, 2026, 00:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.