CVE-2023-3127

🗓️ 11 Jul 2023 21:06:29Reported by jciType

An unauthenticated user logs into iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 with admin rights

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2023-3127	12 Jul 202302:29	–	circl
CNNVD	Johnson Controls iSTAR Ultra 授权问题漏洞	11 Jul 202300:00	–	cnnvd
Cvelist	CVE-2023-3127 Improper Authentication in iSTAR	11 Jul 202321:06	–	cvelist
EUVD	EUVD-2023-43813	3 Oct 202520:07	–	euvd
ICS	Sensormatic Electronics iSTAR	11 Jul 202300:00	–	ics
NVD	CVE-2023-3127	11 Jul 202322:15	–	nvd
OSV	CVE-2023-3127	11 Jul 202322:15	–	osv
Prion	Code injection	11 Jul 202322:15	–	prion
Positive Technologies	PT-2023-23269 · Unknown · Istar Ultra G2 +3	11 Jul 202300:00	–	ptsecurity
Vulnrichment	CVE-2023-3127 Improper Authentication in iSTAR	11 Jul 202321:06	–	vulnrichment

NVD

Node

johnsoncontrols istar_ultra_firmwareRange6.8.6–6.9.2

johnsoncontrols istar_ultra_firmwareMatch6.9.2-

AND

johnsoncontrols istar_ultraMatch-

Node

johnsoncontrols istar_ultra_lt_firmwareRange6.8.6–6.9.2

johnsoncontrols istar_ultra_lt_firmwareMatch6.9.2-

AND

johnsoncontrols istar_ultra_ltMatch-

Node

johnsoncontrols istar_ultra_g2_firmwareRange<6.9.2

johnsoncontrols istar_ultra_g2_firmwareMatch6.9.2-

AND

johnsoncontrols istar_ultra_g2Match-

Node

johnsoncontrols edge_g2_firmwareRange<6.9.2

johnsoncontrols edge_g2_firmwareMatch6.9.2-

AND

johnsoncontrols edge_g2Match-

[
  {
    "defaultStatus": "unaffected",
    "product": "iSTAR Ultra",
    "vendor": "Sensormatic Electronics, a subsidiary of Johnson Controls, Inc.",
    "versions": [
      {
        "lessThan": "6.9.2 CU01",
        "status": "affected",
        "version": ">6.8.6",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "iSTAR Ultra LT",
    "vendor": "Sensormatic Electronics, a subsidiary of Johnson Controls, Inc.",
    "versions": [
      {
        "lessThan": "6.9.2 CU01",
        "status": "affected",
        "version": ">6.8.6",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "iSTAR Ultra G2",
    "vendor": "Sensormatic Electronics, a subsidiary of Johnson Controls, Inc.",
    "versions": [
      {
        "lessThan": "6.9.2 CU01",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "iSTAR Edge G2",
    "vendor": "Sensormatic Electronics, a subsidiary of Johnson Controls, Inc.",
    "versions": [
      {
        "lessThan": "6.9.2 CU01",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
johnsoncontrols	www.johnsoncontrols.com/cyber-solutions/security-advisories
cisa	www.cisa.gov/news-events/ics-advisories/icsa-23-192-02

21 Nov 2024 08:16Current

8.8High risk

Vulners AI Score8.8

CVSS 3.17.5 - 9.8

EPSS0.00202

SSVC

CWE-287

cve-2023-3127 istar ultra istar ultra lt istar ultra g2 istar edge g2 unauthenticated access admin rights