CVE-2025-53695

Johnson Controls, Inc / iSTAR Ultra PUBLISHED

Description (CNA)

OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' user) to the device firmware.

Affected (CNA)

Vendor / product	Versions
Johnson Controls, Inc / iSTAR Ultra	affected 0 through 6.9.2

CWE

CWE-78

References

https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/refs/heads/main/2025-03.txt

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.