Johnson Controls iSTAR Configuration Utility Memory Leak Vulnerability Allowing Unauthorized Data Exposure

A vulnerability exists in the Johnson Controls iSTAR Configuration Utility (ICU) tool, all versions prior to 6.9.5, that causes a memory leak. This leak could unintentionally expose unauthorized data from the Windows PC running the ICU tool. The vulnerability affects only legacy iSTAR products and not the current iSTAR Ultra or iSTAR G2 series controllers.

Impact

Exploitation of this vulnerability could lead to unauthorized access to leaked memory data from the Windows PC running the ICU tool.

Remediation

Users are advised to update the iSTAR Configuration Utility (ICU) tool to version 6.9.5 or greater. For more detailed mitigation instructions, refer to the Johnson Controls Product Security Advisory JCI-PSA-2025-06.