CVE-2017-16744 Path traversal in Niagara AX Framework and Niagara 4 Framework
Authenticated administrators can exploit path traversal in Niagara AX and 4 systems to read or modify arbitrary files on Windows hosts.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-16744?
CVE-2017-16744 is a high-severity path traversal vulnerability in ICS-CERT Niagara AX Framework and Niagara 4 Framework, published on 20 Aug 2018. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A path traversal vulnerability in Tridium Niagara AX Versions 3.8 and prior and Niagara 4 systems Versions 4.4 and prior installed on Microsoft Windows Systems can be exploited by leveraging valid platform (administrator) credentials.
Weakness: CWE-22
Which versions are affected by CVE-2017-16744?
It affects 2 products.
Products include Tridium Niagara, Tridium Niagara Ax Framework.
How do I fix CVE-2017-16744?
No fix has been published for CVE-2017-16744 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2017-16744 being exploited?
There is no known exploitation of CVE-2017-16744 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in ICS-CERT Niagara AX Framework and Niagara 4 Framework
- CVE-2017-16748 An attacker can log into the local Niagara platform (Niagara AX Framework Versions 3.8 and prior or Niagara 4 Framework Versions 4.4 and pri
- CVE-2025-3937 Use of Password Hash with Insufficient Computational Effort
- CVE-2025-3944 Incorrect Permission Assignment for Critical Resource
- CVE-2025-3945 Improper Neutralization of Argument Delimiters in a Command (‘Argument Injection’)
- CVE-2025-3938 Missing Cryptographic Step
Sources
Also known as GHSA-3365-prfc-qrcq.