CVE-2020-14483 Denial of service in Niagara
A timeout during TLS handshake causes Niagara threads to hang, requiring manual restarts and causing denial of service in building automation systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-14483?
CVE-2020-14483 is a medium-severity denial of service vulnerability in Niagara, published on 13 Aug 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A timeout during a TLS handshake can result in the connection failing to terminate. This can result in a Niagara thread hanging and requires a manual restart of Niagara (Versions 4.6.96.28, 4.7.109.20, 4.7.110.32, 4.8.0.110) and Niagara Enterprise Security (Versions 2.4.31, 2.4.45, 4.8.0.35) to correct.
Weakness: CWE-1088
Which versions are affected by CVE-2020-14483?
It affects 2 products.
Products include Tridium Niagara, Tridium Niagara Enterprise Security.
How do I fix CVE-2020-14483?
No fix has been published for CVE-2020-14483 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-14483 being exploited?
There is no known exploitation of CVE-2020-14483 in the wild and no public exploit code.
Other vulnerabilities in Niagara
- CVE-2017-16748 An attacker can log into the local Niagara platform (Niagara AX Framework Versions 3.8 and prior or Niagara 4 Framework Versions 4.4 and pri
- CVE-2025-3937 Use of Password Hash with Insufficient Computational Effort
- CVE-2025-3944 Incorrect Permission Assignment for Critical Resource
- CVE-2025-3945 Improper Neutralization of Argument Delimiters in a Command (‘Argument Injection’)
- CVE-2017-16744 Path traversal in Niagara AX Framework and Niagara 4 Framework
Sources
Also known as GHSA-f98h-fhjw-57pm.