CVE-2025-53696 — Johnson Controls, Inc / iSTAR Ultra

CVE-2025-53696

Johnson Controls, Inc / iSTAR Ultra PUBLISHED

Description (CNA)

iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware. These firmware parts may contain malicious code. Tested up to firmware 6.9.2, later firmwares are also possibly affected.

Affected (CNA)

Vendor / product	Versions
Johnson Controls, Inc / iSTAR Ultra	affected 0 through 6.9.2

CWE

CWE-494

References

https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/refs/heads/main/2025-03.txt

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.