Johnson Controls iSTAR Configuration Utility Stack-Based Buffer Overflow Vulnerability

A stack-based buffer overflow vulnerability has been identified in the Johnson Controls iSTAR Configuration Utility (ICU) tool, specifically in versions prior to 6.9.5. Under certain circumstances, this vulnerability could allow an attacker to execute arbitrary code.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution.

Remediation

Users are advised to upgrade the iSTAR Configuration Utility to version 6.9.5 or greater. For more detailed mitigation instructions, refer to the Johnson Controls Product Security Advisory JCI-PSA-2025-04.