CVE-2025-53695

OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access 'root' user to the device firmware...

CVE-2025-53696

iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware. These firmware parts may contain malicious code. Tested up to firmware 6.9.2, later firmwares are also possibly affected...

CISA Releases Five Industrial Control Systems Advisories

CISA released five Industrial Control Systems ICS advisories on July 29, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-210-01 National Instruments LabVIEW ICSA-25-210-02 Samsung HVAC DMS ICSA-25-210-03 Delta...

CVE-2025-53696

iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware. These firmware parts may contain malicious code. Tested up to firmware 6.9.2, later firmwares are also possibly affected...

CVE-2025-53696

CVE-2025-53696 affects Johnson Controls iSTAR Ultra family (including Ultra SE, Ultra G2, Ultra G2 SE, Edge G2) with firmware versions 6.9.2 and older. The root cause is incomplete boot-time firmware verification, where the boot verification does not inspect certain portions of the firmware, allo...

CVE-2025-53696

iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware. These firmware parts may contain malicious code. Tested up to firmware 6.9.2, later firmwares are also possibly affected...

CVE-2025-53695

OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access 'root' user to the device firmware...

CVE-2025-53695

OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access 'root' user to the device firmware...

CVE-2025-53695

OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access 'root' user to the device firmware...

CVE-2025-53695

CVE-2025-53695 affects Johnson Controls’ iSTAR Ultra family (Ultra, Ultra SE, Ultra G2, Ultra G2 SE, Edge G2). The vulnerability is an OS command injection in the web application that, when exploited by an authenticated attacker, can grant root-level access to the device firmware. Public sources ...

PT-2025-31110 · Unknown · Istar Ultra

Name of the Vulnerable Software and Affected Versions: iSTAR Ultra versions up to 6.9.2 Description: iSTAR Ultra performs a firmware verification on boot, however, the verification does not inspect certain portions of the firmware. These firmware parts may contain malicious code. Recommendations:...

CVE-2025-53696: Download of Code Without Integrity Check

iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware. These firmware parts may contain malicious code. Tested up to firmware 6.9.2, later firmwares are also possibly affected...

CVE-2025-53695: Improper Neutralization of Special Elements used in an OS Command

OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access 'root' user to the device firmware...

Johnson Controls iSTAR Ultra 安全漏洞

Johnson Controls iSTAR Ultra is an access controller from Johnson Controls, Inc. It provides network resiliency and faster processing speeds. A security vulnerability exists in the Johnson Controls iSTAR Ultra that stems from the presence of OS command injection in the web application, which coul...

Johnson Controls iSTAR Ultra 安全漏洞

Johnson Controls iSTAR Ultra is an access controller from Johnson Controls, Inc. It provides network resiliency and faster processing speeds. A security vulnerability exists in Johnson Controls iSTAR Ultra versions 6.9.2 and earlier, which stems from incomplete firmware validation and could lead ...

PT-2025-31108 · Unknown · Istar Ultra

Name of the Vulnerable Software and Affected Versions: iSTAR Ultra products affected versions not specified Description: An OS Command Injection issue exists in the iSTAR Ultra products web application. An authenticated attacker can exploit this to gain privileged access, specifically 'root' user...

CVE-2025-26383

The iSTAR Configuration Utility ICU tool leaks memory, which could result in the unintended exposure of unauthorized data from the Windows PC that ICU is running on...

CVE-2025-26383

The iSTAR Configuration Utility ICU tool leaks memory, which could result in the unintended exposure of unauthorized data from the Windows PC that ICU is running on...

CVE-2025-26383

The iSTAR Configuration Utility ICU tool leaks memory, which could result in the unintended exposure of unauthorized data from the Windows PC that ICU is running on...

CVE-2025-26383

The iSTAR Configuration Utility ICU tool leaks memory, which could result in the unintended exposure of unauthorized data from the Windows PC that ICU is running on...